CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-44954
https://notcve.org/view.php?id=CVE-2021-44954
17 Jul 2022 — In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration. En QVIS NVR DVR versiones anteriores a 13-12-2021, un atacante puede escalar los privilegios de un usuario qvisdvr al usuario root al abusar de una configuración errónea de Sudo • https://gist.github.com/Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/a670418d51051d4e6513d86e84e8d5b8 •
CVSS: 10.0EPSS: 9%CPEs: 4EXPL: 2CVE-2021-41419
https://notcve.org/view.php?id=CVE-2021-41419
17 Jul 2022 — QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. QVIS NVR DVR versiones anteriores a 13-12-2021, es vulnerable a una ejecución de código remota por medio de la deserialización de Java • https://gist.github.com/Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/712ac36c8a08e2698e875169442a23a4 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-6432
https://notcve.org/view.php?id=CVE-2017-6432
09 Mar 2017 — An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information. Se ha descubierto un problema en dispositivos Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06. El Dahua DVR Protocol, que opera en el ... • https://nullku7.github.io/stuff/exploit/dahua/2017/03/09/dahua-nvr-authbypass.html • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2017-6342
https://notcve.org/view.php?id=CVE-2017-6342
27 Feb 2017 — An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117. Dispositivos Dahua DHI-HCVR7216A-... • http://www.securityfocus.com/bid/96454 • CWE-269: Improper Privilege Management •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2017-6341
https://notcve.org/view.php?id=CVE-2017-6341
27 Feb 2017 — Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117. Dispositivos Dahua DHI-HCVR7216A-S3 con NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2... • http://www.securityfocus.com/bid/96456 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.3EPSS: 21%CPEs: 4EXPL: 0CVE-2017-6343
https://notcve.org/view.php?id=CVE-2017-6343
27 Feb 2017 — The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117. La interfaz web de los dispostivos Dahua DHI-HCVR7216A-S3 con NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29 ... • http://www.securityfocus.com/bid/96449 • CWE-287: Improper Authentication •