Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,170 results · page 9 of 24
Dec 8, 2023In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code.CVE-2023-48414 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 4, 2023Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigCVE-2023-42563 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 4, 2023Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attaCVE-2023-42562 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 4, 2023Memory Corruption in camera while installing a fd for a particular DMA buffer.CVE-2023-22383 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory Corruption in camera while installing a fd for a particular DMA buffer.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 3, 2023In cameraisp, there is a possible information disclosure due to improper input validation.CVE-2023-32852 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In cameraisp, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07670971; Issue ID: ALPS07670971.
- Product
- MT6779
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Dec 3, 2023In camera service, there is a possible missing permission check.CVE-2023-42747 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2023In camera service, there is a possible out of bounds read due to a missing bounds check.CVE-2023-42723 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2023In camera service, there is a possible use after free due to a logic error.CVE-2023-42722 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 6.7
In camera service, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privilCVE-2023-45253 · Other software · Huddly · reported by MITREHigh 7.8
An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.
- Product
- Huddlycameraservices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directorCVE-2023-45252 · Other software · Huddly · reported by MITREHigh 7.8
DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges.
- Product
- Huddlycameraservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2023Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.CVE-2023-6118 · Other software · Neutron · reported by iletisim@usom.gov.trHigh 7.5
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1.
- Product
- IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 22, 2023Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera vCVE-2023-3103 · Other software · Unitree Robotics · reported by cve-coordination@incibe.esHigh 8
Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition.
- Product
- A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device.CVE-2023-5747 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.2
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution."
- Product
- PNV-A6081R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Nov 13, 2023badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera.CVE-2023-5037 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.1
badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into request packets to execute command. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- A-Series, Q-Series, PNM-series Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injCVE-2023-4249 · Other software · Zavio · reported by ics-cert@hq.dhs.govHigh 8.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to CVE-2023-45225 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable toCVE-2023-43755 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. During the processing and parsing of certain fields in XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to CVE-2023-3959 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to sCVE-2023-39435 · Other software · Zavio · reported by ics-cert@hq.dhs.govHigh 8.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023In camera driver, there is a possible out of bounds write due to a incorrect bounds check.CVE-2022-48456 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023An issue was discovered on certain ABUS TVIP cameras.CVE-2018-17879 · Other software · Abus · reported by MITRECritical 9.8
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.CVE-2018-17878 · Other software · Abus · reported by MITRECritical 9.8
Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.CVE-2018-17559 · Other software · abus · reported by MITREHigh 7.5
Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.
- Product
- tvip_72500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023A vulnerability regarding use of externally-controlled format string is found in the cgi component.CVE-2023-5746 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Oct 3, 2023The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera CCVE-2023-0506 · Other software · ByDemes Group · reported by cve-coordination@incibe.esHigh 8.8
The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.
- Product
- Airspace CCTV Web Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2023In camera middleware, there is a possible out of bounds write due to a missing input validation.CVE-2023-32827 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993539.
- Product
- MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Oct 1, 2023In camera middleware, there is a possible out of bounds write due to a missing input validation.CVE-2023-32826 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993544.
- Product
- MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Sep 19, 2023The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface.CVE-2023-0773 · Other software · Uniview · reported by vdisclose@cert-in.org.inCritical 9.1
The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device.
- Product
- Uniview IP Camera IPC322LB-SF28-A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.uniview.comcert-in.org.in
Sep 11, 2023Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in aCVE-2022-23382 · Other software · Hichip · reported by MITREHigh 8.1
Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in a local network.
- Product
- Shenzhen Hichip Vision Technology Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlackylab.pllackylab.pl
Sep 6, 2023Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, CVE-2023-30730 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android 12, and 13.0.01.43, 13.1.00.83 in Android 13 allows local attacker to access specific file.
- Product
- Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 3, 2023In camera driver, there is a possible out of bounds write due to a missing bounds check.CVE-2022-48453 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- SC7731E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In camera driver, there is a possible out of bounds read due to a missing bounds check.CVE-2022-47352 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allCVE-2023-38906 · Network & remote access · Tp-link · reported by MITREMedium 6.5
An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the authentication code for the UDP message.
- Product
- Tapo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection.CVE-2023-3386 · Other software · a2 · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.
- Product
- Camera Trap Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 7, 2023In camera middleware, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20797 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In camera middleware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629582; Issue ID: ALPS07629582.
- Product
- MT6879, MT6886, MT6895, MT6983, MT6985, MT8188, MT8195, MT8673
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Aug 6, 2023In camera driver, there is a possible out of bounds read due to a missing bounds check.CVE-2022-47351 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2023In camera driver, there is a possible out of bounds read due to a missing bounds check.CVE-2022-47350 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administCVE-2023-30146 · Other software · assmann · reported by MITREHigh 7.5
Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's settings and the administrator credentials.
- Product
- ht-ip211hdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordde.assmann.shopgithub.com
Jul 19, 2023In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.CVE-2023-3638 · Other software · GeoVision · reported by ics-cert@hq.dhs.govCritical 9.8
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
- Product
- GV-ADR2701
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2023Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enaCVE-2023-32229 · Other software · Bosch · reported by psirt@bosch.comMedium 4.9
Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jun 12, 2023Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.CVE-2023-32220 · Other software · Milesight · reported by cna@cyber.gov.ilHigh 8.2
Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.
- Product
- NCR/camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2023A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attaCVE-2023-0954 · Other software · Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. · reported by productsecurity@jci.comHigh 8.3
A debug feature in Sensormatic Electronics Illustra Pro Gen 4 Dome and PTZ cameras allows a user to compromise credentials after a long period of sustained attack.
- Product
- Illustra Pro Gen 4 Dome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jun 6, 2023The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras.CVE-2023-27126 · Network & remote access · Tp-link · reported by MITREMedium 4.6
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.
- Product
- Tapo C200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaranet.frclaranet.fr
Jun 2, 2023If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in thCVE-2023-28161 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 2, 2023Furbo dog camera has insufficient filtering for special parameter of device log management function.CVE-2023-28704 · Other software · Furbo · reported by twcert@cert.org.twHigh 8.8
Furbo dog camera has insufficient filtering for special parameter of device log management function. An unauthenticated remote attacker in the Bluetooth network with normal user privileges can exploit this vulnerability to perform command injection attack to execute arbitrary system commands or disrupt service.
- Product
- dog camera fireware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 31, 2023Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumenteCVE-2021-45039 · Other software · Uniview · reported by MITRECritical 9.8
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comuniview.com
May 22, 2023Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.CVE-2023-31996 · Other software · Hanwhavision · reported by MITREHigh 8.8
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storage test function.
- Product
- Ane-l6012r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavisionamerica.comhanwhavision.com
May 22, 2023Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).CVE-2023-31995 · Other software · Hanwhavision · reported by MITREMedium 5.4
Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).
- Product
- Ane-l6012r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavisionamerica.comhanwhavision.com
May 20, 2023Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.CVE-2023-33244 · Other software · Obsidian · reported by MITREHigh 8.2
Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.obsidian.mdvuln.ryotak.net
May 15, 2023An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the deviceCVE-2023-29861 · Other software · Flir · reported by MITRECritical 9.8
An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the device.
- Product
- Dvtel Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwoolly-espadrille-ed5.notion.site
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.