Threats Tagged 'c-mor video surveillance v6.0104'

C-MOR Video Surveillance version 6.0104 and earlier contains a Cross-Site Scripting (XSS) vulnerability due to improper input sanitization of the 'size' parameter in ptzpreset.pml and the 'anyparam' parameter in show-movies.pml. An attacker can craft malicious URLs that execute arbitrary JavaScript code when visited by an authenticated user. Proof-of-concept exploit URLs and code have been published. No official patch or vendor advisory is currently available, and there is no evidence of active exploitation in the wild.

C-MOR Video Surveillance version 6.0104 and earlier contains a directory traversal vulnerability in its web interface. This flaw allows unauthenticated attackers to exploit the 'cam' parameter in the show-movies.pml component to read arbitrary files on the server. Proof-of-concept code demonstrates reading sensitive files such as /etc/passwd. No official patch or remediation guidance has been provided by the vendor. There is no evidence of active exploitation in the wild.