CVSS: 4.8EPSS: 0%CPEs: 20EXPL: 0CVE-2021-38701
https://notcve.org/view.php?id=CVE-2021-38701
Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180. Determinados dispositivos Avigilon de Motorola Solutions permiten un ataque de tipo XSS en la interfaz de usuario administrativa. Esto afecta a dispositivos T200/201 versiones anteriores a 4.10.0.68; T290 versiones anteriores a 4.4.0.80; T008 versiones anteriores a 2.2.0.86; T205 versiones anteriores a 4.12.0.62; T204 versiones anteriores a 3.28.0.166; y T100, T101, T102 y T103 versiones anteriores a 2.6.0.180 • https://support.avigilon.com/s/feed/0D54y00006l9eCMCAY https://www.motorolasolutions.com/en_us/about/trust-center/security.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 6%CPEs: 20EXPL: 1CVE-2020-8963
https://notcve.org/view.php?id=CVE-2020-8963
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter. Los dispositivos TimeTools SC7105 versiones 1.0.007, SC9205 versiones 1.0.007, SC9705 versiones 1.0.007, SR7110 versiones 1.0.007, SR9210 versiones 1.0.007, SR9750 versiones 1.0.007, SR9850 versiones 1.0.007, T100 versiones 1.0.003, T300 versiones 1.0.003 y T550 versiones 1.0.003, permiten a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en los parámetros srmodel o srtime del archivo t3.cgi. • https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 20EXPL: 1CVE-2020-8964
https://notcve.org/view.php?id=CVE-2020-8964
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie." Los dispositivos TimeTools SC7105 versiones 1.0.007, SC9205 versiones 1.0.007, SC9705 versiones 1.0.007, SR7110 versiones 1.0.007, SR9210 versiones 1.0.007, SR9750 versiones 1.0.007, SR9850 versiones 1.0.007, T100 versiones 1.0.003, T300 versiones 1.0.003 y T550 versiones 1.0.003, permiten a atacantes remotos omitir la autenticación colocando t3axs=TiMEtOOlsj7G3xMm52wB en una petición del archivo t3.cgi, también se conoce como "hardcoded cookie". • https://sku11army.blogspot.com/2020/02/timetools-sr-sc-series-network-time.html • CWE-798: Use of Hard-coded Credentials •