Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19016 State: PUBLISHED Published: 2019-03-27T17:20:15 Last Updated: 2024-08-05T11:23:08.659Z Vendors: Rockwell Products: Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. Problem Types: CWE-20 Description: Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. A remote attacker could send a crafted UDP packet to the SNMP service causing a denial-of-service condition to occur until the affected product is restarted. Additional Analyst Notes: - CVE Program C
denial-of-service condition to occur until the affected product is restarted. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-036-02
CVE ID: CVE-2018-19017 State: PUBLISHED Published: 2019-01-22T20:00:00Z Last Updated: 2024-09-17T01:00:42.376Z Vendors: ICS-CERT Products: CX-Supervisor Problem Types: CWE-416 Description: Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106654 - https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE ID: CVE-2018-19018 State: PUBLISHED Published: 2019-02-12T22:00:00Z Last Updated: 2024-09-16T20:32:03.769Z Vendors: ICS-CERT Products: CX-Supervisor Problem Types: CWE-824 Description: An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE ID: CVE-2018-19019 State: PUBLISHED Published: 2019-01-22T20:00:00Z Last Updated: 2024-09-17T01:16:24.999Z Vendors: ICS-CERT Products: CX-Supervisor Problem Types: CWE-843 Description: A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106654 - https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE ID: CVE-2018-19020 State: PUBLISHED Published: 2019-02-12T22:00:00Z Last Updated: 2024-09-17T03:27:41.239Z Vendors: ICS-CERT Products: CX-Supervisor Problem Types: CWE-125 Description: When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the application to read a value outside of an array. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE ID: CVE-2018-19021 State: PUBLISHED Published: 2019-01-25T20:00:00Z Last Updated: 2024-09-17T03:52:35.783Z Vendors: Emerson Products: Emerson DeltaV Problem Types: CWE-307 Description: A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106522 - https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01
CVE ID: CVE-2018-19023 State: PUBLISHED Published: 2019-01-25T20:00:00Z Last Updated: 2024-09-16T22:14:20.920Z Vendors: Hetronic Products: Hetronic Nova-M Problem Types: CWE-294 Description: Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-003-03 - http://www.securityfocus.com/bid/106448
CVE ID: CVE-2018-19025 State: PUBLISHED Published: 2020-11-02T16:48:15 Last Updated: 2024-08-05T11:23:08.925Z Vendors: n/a Products: JUUKO K-808 Problem Types: CWE-294 Description: In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01
CVE ID: CVE-2018-19027 State: PUBLISHED Published: 2019-01-30T16:00:00Z Last Updated: 2024-09-16T17:09:00.258Z Vendors: Omron Products: CX-Protocol within CX-One Problem Types: CWE-843 Description: Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106524 - https://ics-cert.us-cert.gov/advisories/ICSA-19-010-02
CVE ID: CVE-2018-19029 State: PUBLISHED Published: 2019-02-05T18:00:00Z Last Updated: 2024-09-16T22:25:18.489Z Vendors: LCDS Products: LCDS Laquis SCADA Problem Types: CWE-822 Description: LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled memory address, which may allow remote code execution, data exfiltration, or cause a system crash. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01 - http://www.securityfocus.com/bid/106634
CVE ID: CVE-2018-19031 State: PUBLISHED Published: 2019-11-04T14:42:42 Last Updated: 2024-08-05T11:23:09.028Z Vendors: 360 Security Technology, Inc. Products: 360 Safe Router Problem Types: Local Code Execution Description: A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series products (360 Safe Router P0,P1,P2,P3,P4), the affected version is V2.0.61.58897. Additional Analyst Notes: - CVE Program Container: References: - https://security.360.cn/News/news/id/188.html
CVE ID: CVE-2018-19036 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T11:23:09.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in the unauthorized execution of code on the device via the network interface. Additional Analyst Notes: - CVE Program Container: References: - https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2018-1202-bt-cve-2018-19036_security_advisory_ip_camera_vulnerability.pdf
CVE ID: CVE-2018-19037 State: PUBLISHED Published: 2019-05-13T12:13:41 Last Updated: 2024-08-05T11:23:08.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open, the router lags and becomes unusable to anyone currently using the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45776/
CVE ID: CVE-2018-19039 State: PUBLISHED Published: 2018-12-13T19:00:00 Last Updated: 2024-08-05T11:23:08.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105994 - https://community.grafana.com/t/grafana-5-3-3-and-4-6-5-security-update/11961 - https://www.percona.com/blog/2018/11/20/how-cve-2018-19039-affects-percona-monitoring-and-management/ - https://access.redhat.com/errata/RHSA-2019:0747 - https://security.netapp.com/advisory/ntap-20190
ring-and-management/ - https://access.redhat.com/errata/RHSA-2019:0747 - https://security.netapp.com/advisory/ntap-20190416-0004/ - https://access.redhat.com/errata/RHSA-2019:0911 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
CVE ID: CVE-2018-19040 State: PUBLISHED Published: 2019-01-31T19:00:00 Last Updated: 2024-08-05T11:23:08.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45809/
CVE ID: CVE-2018-19041 State: PUBLISHED Published: 2019-01-31T19:00:00 Last Updated: 2024-08-05T11:23:09.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45809/
CVE ID: CVE-2018-19042 State: PUBLISHED Published: 2019-01-31T19:00:00 Last Updated: 2024-08-05T11:23:08.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the dir_from and dir_to parameters of an mrelocator_move action to the wp-admin/admin-ajax.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45809/
CVE ID: CVE-2018-19043 State: PUBLISHED Published: 2019-01-31T19:00:00 Last Updated: 2024-08-05T11:30:03.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file renaming (specifying a "from" and "to" filename) via a ../ directory traversal in the dir parameter of an mrelocator_rename action to the wp-admin/admin-ajax.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45809/
CVE ID: CVE-2018-19044 State: PUBLISHED Published: 2018-11-08T20:00:00 Last Updated: 2024-08-05T11:30:03.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306 - https://security.gentoo.org/glsa/201903-01 - https://b
ssen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306 - https://security.gentoo.org/glsa/201903-01 - https://bugzilla.suse.com/show_bug.cgi?id=1015141 - https://github.com/acassen/keepalived/issues/1048 - https://access.redhat.com/errata/RHSA-2019:2285
CVE ID: CVE-2018-19045 State: PUBLISHED Published: 2018-11-08T20:00:00 Last Updated: 2024-08-05T11:30:04.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/acassen/keepalived/commit/5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6 - https://security.gentoo.org/glsa/201903-01 - https://bugzilla.suse.com/show_bug.cgi?id=1015141 - https://github.com/acassen/keepalived/issues/1048 - https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f
ub.com/acassen/keepalived/issues/1048 - https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067
CVE ID: CVE-2018-19046 State: PUBLISHED Published: 2018-11-08T20:00:00 Last Updated: 2024-08-05T11:30:04.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-01 - https://bugzilla.suse.com/sho
Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-01 - https://bugzilla.suse.com/show_bug.cgi?id=1015141 - https://github.com/acassen/keepalived/issues/1048
CVE ID: CVE-2018-19047 State: PUBLISHED Published: 2018-11-07T05:00:00 Last Updated: 2024-08-05T11:30:04.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: mPDF through 7.1.6, if deployed as a web application that accepts arbitrary HTML, allows SSRF, as demonstrated by a '<img src="http://192.168' substring that triggers a call to getImage in Image/ImageProcessor.php. NOTE: the software maintainer disputes this, stating "If you allow users to pass HTML without sanitising it, you're asking for trouble. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mpdf/mpdf/issues/867
CVE ID: CVE-2018-19048 State: PUBLISHED Published: 2019-05-13T13:13:27 Last Updated: 2024-08-05T11:30:04.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hkglue/simditor_demo.git - https://github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fd - https://github.com/hkglue/simditor_dom_xss/blob/master/README.md - https://github.com/mycolorway/simditor/releases/tag/v2.3.22
CVE ID: CVE-2018-19050 State: PUBLISHED Published: 2018-11-07T04:00:00Z Last Updated: 2024-09-16T23:40:52.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md
CVE ID: CVE-2018-19051 State: PUBLISHED Published: 2018-11-07T04:00:00Z Last Updated: 2024-09-16T20:57:55.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m3lon/XSS-Expoit/blob/master/METINFO_XSS.md
CVE ID: CVE-2018-19052 State: PUBLISHED Published: 2018-11-07T05:00:00 Last Updated: 2024-08-05T11:30:04.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1 - http://lists.opensuse.org/op
- https://github.com/lighttpd/lighttpd1.4/commit/2105dae0f9d7a964375ce681e53cb165375f84c1 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00054.html - https://lists.debian.org/debian-lts-announce/2022/01/msg00012.html
CVE ID: CVE-2018-19053 State: PUBLISHED Published: 2018-11-07T05:00:00 Last Updated: 2024-08-05T11:30:03.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a SELECT statement containing this PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Pbootcms/Pbootcms/issues/2
CVE ID: CVE-2018-19056 State: PUBLISHED Published: 2018-11-07T15:00:00 Last Updated: 2024-08-05T11:30:03.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pandao/editor.md/issues/634
CVE ID: CVE-2018-19057 State: PUBLISHED Published: 2018-11-07T15:00:00 Last Updated: 2024-08-05T11:30:04.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sparksuite/simplemde-markdown-editor/issues/721
CVE ID: CVE-2018-19058 State: PUBLISHED Published: 2018-11-07T16:00:00 Last Updated: 2024-08-05T11:30:03.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3837-1/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00008.html - https://gitlab.freedesktop.org/poppler/poppler/issues/659 - https://access.redhat.com/errata/RHSA-2019:2022 - https://lists.debian.org/debian-lts-announce/2020
poppler/issues/659 - https://access.redhat.com/errata/RHSA-2019:2022 - https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html
CVE ID: CVE-2018-19059 State: PUBLISHED Published: 2018-11-07T16:00:00 Last Updated: 2024-08-05T11:30:04.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating embedded files before save attempts. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/661 - https://usn.ubuntu.com/3837-1/ - https://access.redhat.com/errata/RHSA-2019:2022
CVE ID: CVE-2018-19060 State: PUBLISHED Published: 2018-11-07T16:00:00 Last Updated: 2024-08-05T11:30:03.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3837-1/ - https://gitlab.freedesktop.org/poppler/poppler/issues/660 - https://access.redhat.com/errata/RHSA-2019:2022
CVE ID: CVE-2018-19061 State: PUBLISHED Published: 2018-11-07T17:00:00Z Last Updated: 2024-09-16T20:32:02.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moonf1sh/moonf1sh.github.io/blob/master/2018/10/30/DedeCMS-V57-SQL%E6%B3%A8%E5%85%A5/index.html - https://moonf1sh.github.io/2018/10/30/DedeCMS-V57-SQL%E6%B3%A8%E5%85%A5/
CVE ID: CVE-2018-19063 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:03.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19064 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:04.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ftpuser1 account has a blank password, which cannot be changed. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19065 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:03.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded BpP+2R9*Q password in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19066 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:04.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded Pxift* password in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19067 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:03.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory~ account. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19068 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:04.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for hidden factory credentials. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt
CVE ID: CVE-2018-19069 State: PUBLISHED Published: 2018-11-07T18:00:00 Last Updated: 2024-08-05T11:30:03.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for the root user with a password of toor. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt