CVE-2019-14707

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI...

Remote code execution

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI...

PT-2019-13796

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras with firmware through 6400.0.8.5 Description A CSRF issue was discovered in the HTTPD service, specifically affecting the "webparam?user&action=set&param=add" API endpoint. This issue can be exploited to create an...

CVE-2019-14707: Undefined Security Weakness

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI...

CVE-2019-14703: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin account...

PT-2019-13799

Name of the Vulnerable Software and Affected Versions MicroDigital N-series cameras versions through 6400.0.8.5 Description An issue was discovered in the firmware update process of the affected cameras, which is insecure and can lead to remote code execution. The attacker can provide arbitrary...

Sql injection

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...

CVE-2018-17796

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...