CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22957
https://notcve.org/view.php?id=CVE-2021-22957
24 Nov 2021 — A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect application Version 1.20.0 and later. Una vulnerabilidad de intercambio de recursos entre orígenes (CORS) encontrada en la aplicación UniFi Protect versión 1.19.2 y anteriores, permite que un actor malicioso que haya conve... • https://community.ui.com/releases/Security-Advisory-Bulletin-021-021/62bd8841-6603-4fee-9dba-73037148f173 • CWE-16: Configuration •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22943
https://notcve.org/view.php?id=CVE-2021-22943
31 Aug 2021 — A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently control the Protect camera(s) assigned to said network. This vulnerability is fixed in UniFi Protect application V1.19.0 and later. Una vulnerabilidad encontrada en la aplicación UniFi Protect versiones V1.18.1 y anteriores, permite a un actor malicioso que ya ha conseguido acceso a una red controlar posteriormente la(s) cámara(s) Protect asignada(s) a d... • https://community.ui.com/releases/Security-Advisory-Bulletin-019-019/90a00abe-d6b6-43c6-92d4-0a0342f1506f • CWE-287: Improper Authentication •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22944
https://notcve.org/view.php?id=CVE-2021-22944
31 Aug 2021 — A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privileges as the owner of the UniFi Protect application. This vulnerability is fixed in UniFi Protect application V1.19.0 and later. Una vulnerabilidad encontrada en la aplicación UniFi Protect versiones V1.18.1 y anteriores, permite a un actor malicioso con un rol de sólo vista y acceso a la red alcanzar los mismos privilegios que el propietario de la ap... • https://community.ui.com/releases/Security-Advisory-Bulletin-019-019/90a00abe-d6b6-43c6-92d4-0a0342f1506f •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22882
https://notcve.org/view.php?id=CVE-2021-22882
23 Feb 2021 — UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash. UniFi Protect versiones anteriores a v1.17.1, permite a un atacante usar cámaras falsificadas para llevar a cabo un ataque de denegación de servicio que puede causar que el controlador UniFi Protect se bloquee • https://community.ui.com/releases/Security-advisory-bulletin-017-017/071141e5-bc2e-4b71-81f3-5e499316fcee • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8267
https://notcve.org/view.php?id=CVE-2020-8267
05 Nov 2020 — A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.... • https://community.ui.com/releases/UniFi-Dream-Machine-Firmware-1-8-0/deabc255-a081-49ba-8f51-131f3a13000a • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8213
https://notcve.org/view.php?id=CVE-2020-8213
30 Jul 2020 — An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing. Se presenta una vulnerabilidad de exposición de información en UniFi Protect en versiones anteriores a v1.13.4-beta.5, que permitía a atacantes no autenticados acceder a nombres de usuario validos para la aplicación web UniFi Protect por medio del código de respuesta HTTP y la sin... • https://community.ui.com/releases/Security-advisory-bulletin-013-013/56d4d616-4afd-40ee-863f-319b7126ed84 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-8188
https://notcve.org/view.php?id=CVE-2020-8188
02 Jul 2020 — We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectively that fixes vulnerabilities found on Protect firmware v1.13.2, v1.14.9 and prior according to the description below:View only users can run certain custom commands which allows them to assign themselves unauthorized roles and escalate their privileges. Recientemente hemos publicado una nueva versión del firmware UniFi Protect versión v1.13.3 y v1.14.... • https://community.ui.com/releases/Security-advisory-bulletin-012-012/1bba9134-f888-4010-81c0-b0dd53b9bda4 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •