CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49114 – Local Privilege Escalation via DLL Hijacking
https://notcve.org/view.php?id=CVE-2023-49114
26 Feb 2024 — A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met. Se identificó una vulnerabilidad de secuestro de DLL en Qognify VMS Client Viewer versión 7.1 o superior, que permite a los usuarios locales ejecutar código arbitrario y obtener mayores privilegios mediante la colocación cuidadosa de un DLL malicio... • http://seclists.org/fulldisclosure/2024/Mar/10 • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2306 – Qognify NiceVision Use of Hard-coded Credentials
https://notcve.org/view.php?id=CVE-2023-2306
05 Oct 2023 — Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records. Las versiones 3.1 y anteriores de Qognify NiceVision son vulnerables a la exposición de información confidencial mediante credenciales codificadas. Con estas credenciales, un atacante puede recuperar información sobre las cámaras, información del usuario y modifica... • https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-02 • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 6%CPEs: 1EXPL: 0CVE-2020-27868 – Qognify Ocularis EventCoordinator ConnectedChannel_GotMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-27868
29 Dec 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of serialized objects provided to the EventCoordinator endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTE... • https://www.qognify.com/support-training/software-downloads • CWE-502: Deserialization of Untrusted Data •