CVE-2024-45176

CVE-2024-45176 affects za-internet C-MOR Video Surveillance 5.2401. The vulnerability is a reflected Cross-Site Scripting (XSS) in the C-MOR web interface caused by insufficient input validation on various functions. Reported impact is limited to confidentiality and integrity (Low), with no impac...

CVE-2024-45179

The CVE affects za-internet C-MOR Video Surveillance versions 5.2401–6.00PL01. Root cause: insufficient input validation in the web interface enables OS command injection via HTTP POST data. Notable vulnerable components include generatesslreq.pml (allows low-privileged authenticated users to run...

CVE-2024-45174

CVE-2024-45174 affects za-internet C-MOR Video Surveillance versions 5.2401–6.00PL01. The issue is an SQL injection in the web interface caused by improper validation of user-supplied data, enabling an authenticated user to execute arbitrary SQL commands in the MySQL database. CVSSv3.1 base score...

CVE-2024-45177

za-internet C-MOR Video Surveillance versions 5.2401–6.00PL01 are vulnerable to persistent cross-site scripting via the web interface due to inadequate input validation. The PT Security advisory notes this can allow remote script injection. Remediation: apply the patch for 5.2401 and 6.00PL01; up...

CVE-2024-45170

CVE-2024-45170 affects za-internet C-MOR Video Surveillance 5.2401. The issue is improper or missing access control: low-privileged users can invoke administrative functions via the web interface by sending HTTP requests, because server-side checks are absent though the UI restricts the features....

CVE-2024-45172

The CVE-2024-45172 entry describes CSRF vulnerability in za-internet C-MOR Video Surveillance web interface for versions 5.2401 and 6.00PL01 due to missing protection mechanisms. Affected component is the C-MOR web interface; root cause is lack of CSRF protection. Documented impact is that CSRF c...

CVE-2024-45173

The CVE-2024-45173 vulnerability affects za-internet C-MOR Video Surveillance (versions 5.2401 and 6.00PL01 per the various sources). It stems from improper privilege management of sudo privileges, allowing the web interface user (www-data) to execute certain OS commands as root without a root pa...

CVE-2024-45175

The CVE-2024-45175 affects za-internet C-MOR Video Surveillance (versions 5.2401 and 6.00PL01 per SYSS advisory and PacketStorm). The root cause is cleartext storage of sensitive data (e.g., camera login credentials), which can be accessed by an attacker with filesystem access (e.g., via path tra...

CVE-2024-45178

CVE-2024-45178 affects za-internet C-MOR Video Surveillance 5.2401. The issue is path traversal caused by insufficient input validation, enabling an authenticated user to download arbitrary files as user www-data via vulnerable scripts download-bkf.pml (parameter bkf) and show-movies.pml (paramet...

CVE-2024-45171

CVE-2024-45171 affects za-internet C-MOR Video Surveillance 5.2401. Affected component: web upload for backups; root cause is improper input validation allowing authenticated low-privilege users to upload arbitrary files when the filename contains .cbkf, enabling storage of webshell.cbkf.php unde...