2 results (0.009 seconds)

CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 1

CVE-2018-18441

https://notcve.org/view.php?id=CVE-2018-18441

20 Dec 2018 — D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: /common/info.cgi, with no authentication. The configuration file include... • https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 62EXPL: 3

CVE-2017-7852 – D-Link DCS Series Cameras - Insecure Crossdomain

https://notcve.org/view.php?id=CVE-2017-7852

24 Apr 2017 — D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings via a CSRF attack. This is because of the 'allow-access-from domain' child element set to *, thus accepting requests from any domain. If a victim logged into the camera's web console visits a malicious site hosting a malicious Flash file from another Browser tab, the malicious Flash file then can send requests to the victim's DCS series Camera without k... • https://packetstorm.news/files/id/142702 • CWE-352: Cross-Site Request Forgery (CSRF) •