Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,299 results · page 35 of 46
Jul 9, 2018Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP CVE-2018-6830 · Other software · Foscam · reported by MITREHigh 7.5
Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the URI path component.
- Product
- C1 Lite Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.vdoo.comfoscam.com
Jul 9, 2018The mintToken function of a smart contract implementation for VICETOKEN_ICO_IS_A_SCAM, an Ethereum token, has an integer overflow that allows the owner of the cCVE-2018-13618 · Other software · Vicetoken ICO IS A Scam Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for VICETOKEN_ICO_IS_A_SCAM, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Vicetoken ICO IS A Scam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for Super Cool Awesome Money (SCAM), an Ethereum token, has an integer overflow that allows the owner CVE-2018-13516 · Other software · Supercoolawesomemoney · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for Super Cool Awesome Money (SCAM), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Super Cool Awesome Money
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2018Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android releases(Android for CVE-2017-15851 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comvulnerabilitycenter.com
Jul 6, 2018Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) CVE-2018-5832 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7
Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, a Use After Free condition can occur.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comcodeaurora.org
Jul 3, 2018In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear tCVE-2018-7782 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.8
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
- Product
- Pelco Sarix Professional V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Jul 3, 2018In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authentCVE-2018-7781 · Other software · Schneider Electric SE · reported by cybersecurity@se.comHigh 8.8
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.
- Product
- Pelco Sarix Professional V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Jul 3, 2018In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi progCVE-2018-7780 · Other software · Schneider Electric SE · reported by cybersecurity@se.comCritical 9.8
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".
- Product
- Pelco Sarix Professional V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordschneider-electric.comschneider-electric.com
Jun 26, 2018An issue was discovered in the httpd process in multiple models of Axis IP Cameras.CVE-2018-10664 · Other software · Axis · reported by MITREHigh 7.5
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018An issue was discovered in multiple models of Axis IP Cameras.CVE-2018-10663 · Other software · Axis · reported by MITREHigh 7.5
An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018An issue was discovered in multiple models of Axis IP Cameras.CVE-2018-10662 · Other software · Axis · reported by MITRECritical 9.8
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018An issue was discovered in multiple models of Axis IP Cameras.CVE-2018-10661 · Other software · Axis · reported by MITRECritical 9.8
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018An issue was discovered in multiple models of Axis IP Cameras.CVE-2018-10660 · Other software · Axis · reported by MITRECritical 9.8
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sendiCVE-2018-10659 · Other software · Axis · reported by MITREHigh 7.5
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash).CVE-2018-10658 · Other software · Axis · reported by MITREHigh 7.5
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar.
- Product
- A1001 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2018The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or usr key in a GET request on port 34100.CVE-2018-12640 · Other software · Insteon · reported by MITRECritical 9.8
The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or usr key in a GET request on port 34100.
- Product
- 2864-222 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2018The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, CVE-2018-11560 · Other software · Insteon · reported by MITRECritical 9.8
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.
- Product
- 2864-222 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF (Android for MCVE-2017-15857 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeaurora.orgsource.android.com
Jun 4, 2018Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase.CVE-2017-16023 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.
- Product
- decamelize node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnodesecurity.io
Apr 27, 2018IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated useCVE-2017-1116 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated user to conduct other attacks. IBM X-Force ID: 121154.
- Product
- Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Apr 24, 2018An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2CVE-2017-2833 · Other software · Foscam · reported by talos-cna@cisco.comHigh 7.5
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability, an attacker needs to send an HTTP request and reboot the device.
- Product
- Indoor IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Apr 24, 2018An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2CVE-2017-2832 · Other software · Foscam · reported by talos-cna@cisco.comHigh 7.2
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
- Product
- Indoor IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Apr 18, 2018There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a deCVE-2018-6413 · Network & remote access · hikvision · reported by hsrc@hikvision.comHigh 7.5
There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a denial of service attack (service interruption) via a crafted network setting interface request.
- Product
- DS-2CD9111-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww1.hikvision.comwww1.hikvision.com
Apr 17, 2018Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43.CVE-2017-2871 · Other software · Talos · reported by talos-cna@cisco.comHigh 8.8
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery using a custom image.
- Product
- Foscam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 6, 2018The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled datCVE-2018-9838 · Other software · Ocaml · reported by MITRECritical 9.8
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.
- Product
- Ocaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcaml.inria.frsecurity.gentoo.org
Apr 1, 2018An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices.CVE-2018-9158 · Other software · Axis · reported by MITREHigh 7.5
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. They don't employ a suitable mechanism to prevent a DoS attack, which leads to a response time delay. An attacker can use the hping3 tool to perform an IPv4 flood attack, and the services are interrupted from attack start to end.
- Product
- M1033-w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslideshare.netslideshare.net
Apr 1, 2018An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices.CVE-2018-9157 · Other software · Axis · reported by MITREHigh 7.5
An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
- Product
- M1033-w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslideshare.netslideshare.net
Apr 1, 2018An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices.CVE-2018-9156 · Other software · Axis · reported by MITREHigh 7.5
An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality
- Product
- P1354 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordslideshare.netslideshare.net
Mar 30, 2018Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver.CVE-2017-15852 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 30, 2018In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference CVE-2017-15846 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference may potentially occur.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.codeaurora.org
Mar 28, 2018An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password CVE-2017-11510 · Other software · Wanscam · reported by vulnreport@tenable.comCritical 9.8
An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password via an ONVIF GetSnapshotUri request.
- Product
- Wanscam HW0021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2018Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may CVE-2018-7532 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govCritical 9.8
Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow remote code execution.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allCVE-2018-7528 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govCritical 9.1
An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an attacker to alter stored data.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, wCVE-2018-7524 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govHigh 8.8
A cross-site request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow an unauthorized user to be added to the system.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, whiCVE-2018-7520 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govCritical 9.8
An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could allow a full configuration download, including passwords.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, CVE-2018-7516 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govHigh 7.3
A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could lead to proxied network scans.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which mCVE-2018-7512 · Other software · Geutebrück · reported by ics-cert@hq.dhs.govMedium 6.1
A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow remote code execution.
- Product
- Geutebrück G-Cam/EFD-2250 (part n° 5.02024) firmware and Topline TopFD-2125 (part n° 5.02820) firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 13, 2018Denial of service by uploading malformed firmware in Hanwha Techwin SmartcamsCVE-2018-6303 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comHigh 7.5
Denial of service by uploading malformed firmware in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin SmartcamsCVE-2018-6302 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comHigh 7.5
Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Arbitrary camera access and monitoring via cloud in Hanwha Techwin SmartcamsCVE-2018-6301 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comHigh 7.5
Arbitrary camera access and monitoring via cloud in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Remote password change in Hanwha Techwin SmartcamsCVE-2018-6300 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Remote password change in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Authentication bypass in Hanwha Techwin SmartcamsCVE-2018-6299 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Authentication bypass in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Remote code execution in Hanwha Techwin SmartcamsCVE-2018-6298 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Remote code execution in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Buffer overflow in Hanwha Techwin SmartcamsCVE-2018-6297 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Buffer overflow in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018An undocumented (hidden) capability for switching the web interface in Hanwha Techwin SmartcamsCVE-2018-6296 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comMedium 5.3
An undocumented (hidden) capability for switching the web interface in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Unencrypted way of remote control and communications in Hanwha Techwin SmartcamsCVE-2018-6295 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Unencrypted way of remote control and communications in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Mar 13, 2018Unsecured way of firmware update in Hanwha Techwin SmartcamsCVE-2018-6294 · Other software · Hanwha Techwin · reported by vulnerability@kaspersky.comCritical 9.8
Unsecured way of firmware update in Hanwha Techwin Smartcams
- Product
- Hanwha Techwin Smartcams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurelist.comsecurelist.com
Feb 26, 2018An issue was discovered on Wireless IP Camera 360 devices.CVE-2017-11635 · Other software · - · reported by MITREHigh 7.5
An issue was discovered on Wireless IP Camera 360 devices. Attackers can read recordings by navigating to /mnt/idea0 or /mnt/idea1 on the SD memory card.
- Product
- Wireless IP Camera 360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2018An issue was discovered on Wireless IP Camera 360 devices.CVE-2017-11634 · Other software · - · reported by MITRECritical 9.8
An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and reading the password field of the debugging information, e.g., nTBCS19C corresponds to a password of 123456.
- Product
- Wireless IP Camera 360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2018An issue was discovered on Wireless IP Camera 360 devices.CVE-2017-11633 · Other software · - · reported by MITREHigh 7.5
An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover RTSP credentials by connecting to TCP port 9527 and reading the InsertConnect field.
- Product
- Wireless IP Camera 360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.