GeoHttpServer, when configured to authenticate users, allows remote attackers to bypass authentication and access unauthorized files via a URL that contains %0a%0a (encoded newlines).
Max CVSS
5.0
EPSS Score
0.55%
Published
2004-12-31
Updated
2016-10-18
The sysinfo script in GeoHttpServer allows remote attackers to cause a denial of service (crash) via a long pwd parameter, possibly triggering a buffer overflow.
Max CVSS
5.0
EPSS Score
0.95%
Published
2004-12-31
Updated
2017-07-11
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0, when set to create JPEG images, does not properly protect an image even when a password and username is assigned, which may allow remote attackers to gain sensitive information via a direct request to the image.
Max CVSS
5.0
EPSS Score
2.93%
Published
2005-05-14
Updated
2017-07-11
GeoVision Digital Video Surveillance System 6.04, 6.1 and 7.0 uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the password via sniffing.
Max CVSS
7.5
EPSS Score
0.81%
Published
2005-05-14
Updated
2017-07-11
Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.
Max CVSS
8.8
EPSS Score
0.77%
Published
2009-03-10
Updated
2017-10-19
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote attackers to execute arbitrary code by calling the GetAudioPlayingTime method with certain arguments.
Max CVSS
9.3
EPSS Score
12.86%
Published
2009-03-25
Updated
2018-10-10
Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET request.
Max CVSS
5.0
EPSS Score
3.04%
Published
2011-09-12
Updated
2018-10-10
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
Max CVSS
9.8
EPSS Score
0.38%
Published
2019-08-29
Updated
2020-10-02
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
Max CVSS
6.1
EPSS Score
0.09%
Published
2019-08-29
Updated
2019-10-09
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.
Max CVSS
7.5
EPSS Score
0.20%
Published
2019-08-29
Updated
2020-10-08
GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.
Max CVSS
4.0
EPSS Score
0.04%
Published
2020-06-12
Updated
2020-07-23
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
Max CVSS
9.8
EPSS Score
0.45%
Published
2020-07-08
Updated
2020-07-16
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
Max CVSS
9.8
EPSS Score
0.09%
Published
2023-07-19
Updated
2023-07-28
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default installation and allows attackers to execute arbitrary code and gain escalated privileges.
Max CVSS
9.8
EPSS Score
0.20%
Published
2023-05-04
Updated
2023-05-10
14 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!