Vulnerabilidades

*** Pendiente de traducción *** A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS V20 20.0.2. <br /> <br /> <br /> A specially crafted network request can lead to a denial of service. An attacker can impersonate the legitimate server to trigger this vulnerability.

*** Pendiente de traducción *** GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.<br /> <br /> DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. <br /> <br /> <br /> <br /> Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:<br /> <br /> <br /> #### Net Mask field stack overflow<br /> <br /> The following code is vulnerable to a stack overflow that is attacker-controlled:<br /> <br /> <br /> <br /> v6 = strlen(g_network_config-&gt;net_mask);<br /> <br /> memcpy(&amp;reply_buf[184], g_network_config-&gt;net_mask, v6);

*** Pendiente de traducción *** GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.<br /> <br /> DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. <br /> <br /> <br /> <br /> Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:<br /> <br /> <br /> #### Gateway field stack overflow<br /> <br /> The following code is vulnerable to a stack overflow that is attacker-controlled:<br /> <br /> <br /> <br /> v7 = strlen(g_network_config-&gt;gateway);<br /> <br /> memcpy(&amp;reply_buf[216], g_network_config-&gt;gateway, v7);

*** Pendiente de traducción *** GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.<br /> <br /> DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. <br /> <br /> <br /> <br /> Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:<br /> <br /> <br /> <br /> #### DNS field stack overflow<br /> <br /> The following code is vulnerable to a stack overflow that is attacker-controlled:<br /> <br /> <br /> <br /> v8 = strlen(g_network_config-&gt;dns_addr);<br /> <br /> memcpy(&amp;reply_buf[248], g_network_config-&gt;dns_addr, v8);

*** Pendiente de traducción *** Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.<br /> <br /> <br /> `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.)<br /> <br /> <br /> <br /> #### CNetSetObj::m_F_n_Set_Net_Mask command injection<br /> <br /> The following function takes a string as a net mask address, performs no sanitization on it and calls `system`. This is a classic command injection vulnerability. The function is reachable from both the network-exposed `DVRSearch` service and the `Network.cgi` endpoint. <br /> <br /> <br /> <br /> int __fastcall CNetSetObj::m_F_n_Set_Net_Mask(const char **this, char *netmask_addr)<br /> <br /> {<br /> <br /> bool v2; // zf<br /> <br /> char v4[72]; // [sp+0h] [bp-48h] BYREF<br /> <br /> <br /> <br /> v2 = *this == 0;<br /> <br /> if ( *this )<br /> <br /> v2 = netmask_addr == 0;<br /> <br /> if ( v2 )<br /> <br /> return 0;<br /> <br /> sprintf(v4, "/sbin/ifconfig %s netmask %s", *this, netmask_addr); // attacker controlled netmask_addr<br /> <br /> system(v4);<br /> <br /> return 1;<br /> <br /> }

*** Pendiente de traducción *** GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485.<br /> <br /> DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. <br /> <br /> <br /> <br /> Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable:<br /> <br /> <br /> #### IP field stack overflow<br /> <br /> The following code is vulnerable to a stack overflow that is attacker-controlled:<br /> <br /> <br /> <br /> v3 = strlen(g_network_config-&gt;ip_addr);<br /> <br /> memcpy(&amp;reply_buf[36], g_network_config-&gt;ip_addr, v3);

*** Pendiente de traducción *** The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "Partial Filled Form Entries" page in the ARForms dashboard.

*** Pendiente de traducción *** The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &amp;#39;custom_attributes&amp;#39; parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

*** Pendiente de traducción *** Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.

*** Pendiente de traducción *** Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.

*** Pendiente de traducción *** Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.

*** Pendiente de traducción *** When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.