CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49114 – Local Privilege Escalation via DLL Hijacking
https://notcve.org/view.php?id=CVE-2023-49114
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met. Se identificó una vulnerabilidad de secuestro de DLL en Qognify VMS Client Viewer versión 7.1 o superior, que permite a los usuarios locales ejecutar código arbitrario y obtener mayores privilegios mediante la colocación cuidadosa de un DLL malicioso, si se cumplen algunas condiciones previas específicas. Qognify VMS Client Viewer version 7.1 suffers from a local privilege escalation vulnerability via DLL hijacking. • http://seclists.org/fulldisclosure/2024/Mar/10 https://r.sec-consult.com/qognify • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2306 – Qognify NiceVision Use of Hard-coded Credentials
https://notcve.org/view.php?id=CVE-2023-2306
Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records. Las versiones 3.1 y anteriores de Qognify NiceVision son vulnerables a la exposición de información confidencial mediante credenciales codificadas. Con estas credenciales, un atacante puede recuperar información sobre las cámaras, información del usuario y modificar registros de la base de datos. • https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02 • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 18%CPEs: 1EXPL: 0CVE-2020-27868 – Qognify Ocularis EventCoordinator ConnectedChannel_GotMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-27868
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of serialized objects provided to the EventCoordinator endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://www.qognify.com/support-training/software-downloads https://www.zerodayinitiative.com/advisories/ZDI-20-1453 • CWE-502: Deserialization of Untrusted Data •