Electrolink FM/DAB/TV Transmitter devices are prone to a credentials disclosure vulnerability. Attackers can exploit this issue to gain access to sensitive information such as login credentials. This vulnerability affects multiple versions of the Electrolink transmitters including Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter, and UHF TV Transmitter.
Electrolink FM/DAB/TV Transmitter devices are prone to a credentials disclosure vulnerability. Attackers can exploit this issue to gain unauthorized access to sensitive information such as login credentials. This vulnerability affects various versions of Electrolink transmitters including Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter, and UHF TV Transmitter.
Electrolink FM/DAB/TV Transmitter devices are prone to a credentials disclosure vulnerability. Attackers can exploit this issue to gain unauthorized access to sensitive information, potentially leading to further attacks.
Electrolink FM/DAB/TV Transmitter devices are prone to a credentials disclosure vulnerability. Attackers can access sensitive information such as login credentials by directly visiting certain web pages like login.htm and mail.htm on the affected devices.
This exploit allows a remote user with access to the web server to send a POST request to disclose the username and password of the target application. The disclosed credentials are Windows credentials with Administrator privileges. This vulnerability can be exploited after the Administrator user has logged in at least once in each Tomcat session.
C2S DVR allows an unauthenticated user to disclose the username & password remotely by a simple request to the server page 'read.cgi?page=2'. Moreover, an attacker could easily access the password change page without any authentication, as the web application does not perform any session management.
The download module does not correctly check the file parameter, allowing for directory traversal and the ability to download all files hosted in the target web space.
The application stores logs and sensitive information in an unencrypted binary file called BEWARD.INTERCOM.FDB. A local attacker that has access to the current user session can successfully disclose plain-text credentials that can be used to bypass authentication to the affected IP camera and door station and bypass access control in place.
The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker to disclose RTSP credentials in plain-text.
The application stores sensitive information in an unencrypted XML file called /config/server.xml. A local attacker that has access to the current user session can successfully disclose plain-text credentials that can be used to bypass authentication to the affected server.
Services By CQR