CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26973
https://notcve.org/view.php?id=CVE-2022-26973
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the license file name, the returned error message exposes internal directory path details. La aplicación web Barco Control Room Management Suite, que forma parte de TransForm N versiones anteriores a 3.14, expone un mecanismo de carga de archivos de licencia. Al modificar el nombre del archivo de licencia, el mensaje de error devuelto expone detalles de la ruta del directorio interno • https://www.barco.com/en/support/knowledge-base/KB12678 https://www.barco.com/en/support/transform-n-management-server • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26972
https://notcve.org/view.php?id=CVE-2022-26972
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not correctly sanitized, leading to reflected XSS. La aplicación web Barco Control Room Management Suite, que forma parte de TransForm N versiones anteriores a 3.14, expone un endpoint URL /cgi-bin. Los parámetros de la URL no están correctamente saneados, conllevando a un XSS reflejado • https://www.barco.com/en/support/knowledge-base/KB12685 https://www.barco.com/en/support/transform-n-management-server • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26971
https://notcve.org/view.php?id=CVE-2022-26971
Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be executed without authentication. La aplicación web Barco Control Room Management Suite, que forma parte de TransForm N versiones anteriores a 3.14, expone un mecanismo de carga de archivos de licencia. Esta carga puede ser ejecutada sin autenticación • https://www.barco.com/en/support/knowledge-base/KB12681 https://www.barco.com/en/support/transform-n-management-server • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2022-26233 – Barco Control Room Management Suite Directory Traversal
https://notcve.org/view.php?id=CVE-2022-26233
Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive information and components. Requests must begin with the "GET /..\.." substring. Se ha detectado que Barco Control Room Management versiones hasta Suite 2.9 Build 0275, es vulnerable a un salto de directorio, permitiendo a atacantes acceder a información y componentes confidenciales. Las solicitudes deben comenzar con la subcadena "GET /..\N" Barco Control Room Management Suite versions prior to 2.9 build 0275 suffer from a directory traversal vulnerability. • http://packetstormsecurity.com/files/166577/Barco-Control-Room-Management-Suite-Directory-Traversal.html http://seclists.org/fulldisclosure/2022/Apr/0 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38142
https://notcve.org/view.php?id=CVE-2021-38142
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS). Barco MirrorOp Windows Sender versiones anteriores a 2.5.3.65, usa HTTP en texto sin cifrar, y por lo tanto, permite actualizaciones de software fraudulentas. Un atacante en la red local puede lograr una ejecución de código remota en cualquier equipo que intente actualizar Windows Sender debido a que el mecanismo de actualización no es seguro (no está protegido con TLS) • https://www.barco.com/en/support/cms https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65 • CWE-319: Cleartext Transmission of Sensitive Information •