TBK DVR Auth Bypass (CVE-2018-9995)

Exploits CVE-2018-9995 in TBK/rebranded DVRs: Cookie uid=admin bypasses auth and /device.rsp?opt=user&cmd=list returns all user credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR cookie auth bypass credential leak CVE-2018-9995.""" import json from kittysploit import from...

TBK DVR4104/DVR4216 Devices - Authentication Bypass Detection

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

PT-2019-9675

Name of the Vulnerable Software and Affected Versions Vignette Content Management version 6 Description The issue allows for remote access to administrator privileges by discovering the admin password in the "vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin" HTML source code, and then...

Authentication flaw

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

CVE-2018-9995: Undefined Security Weakness

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...