In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
#Digital sentry ptz code
Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execute arbitrary HTML and script code in a user’s browser session.Ī Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.Ī Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.Ī Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands.Ī Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.Īn Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Digital Sentry Server 7.4 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "") to overwrite arbitrary files. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The victim would have to visit a malicious webpage using Internet Explorer where the exploit could be triggered.ĭSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code.
The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.4 has a SetCameraConnectionParameter stack-based buffer overflow.
0 kommentar(er)
