| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The RSA cryptographic
key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations. |
| An
API key is hardcoded and retrievable from the GV-Face package. Since
Android applications can be reverse engineered, embedding sensitive API
credentials directly in the client application may allow unauthorized users to
extract and misuse the key. |
| The RSA cryptographic key material, including a private key and public key, is
embedded within the application package. Because Android applications can
be extracted and reverse engineered, storing private cryptographic keys
directly inside the client application may allow an attacker to recover the
keys and potentially use them to impersonate the application, decrypt protected
data, or generate unauthorized cryptographic operations. |
| GV-Face transmits sensitive user credentials and
related authentication data over unencrypted HTTP connections. The HTTP
traffic is not encrypted, an attacker with the ability to intercept network
traffic. |
| The RSA cryptographic key
material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations. |
| An API key is
hardcoded and retrievable from the GV-Cloud application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key. |
| An
API key is hardcoded and retrievable from the GV-Access package. Since
Android applications can be reverse engineered, embedding sensitive API
credentials directly in the client application may allow unauthorized users to
extract and misuse the key. |
| A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
| A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . |
| GV-E-Map
Server V18.2.0A contains a plaintext database password embedded within an
application component. The credential can be recovered through static analysis
of the distributed binary and may also be exposed in process memory during
runtime. |
| An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key. |
| API
key is hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key. |
| Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. The
request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
plaintext across the network. An attacker with the ability to monitor network
traffic could intercept the request and obtain the key |
| A DLL hijacking
vulnerability exists in the GeoVision GV-Remote E-Map desktop
application. The application loads one or more dynamic-link libraries (DLLs)
from an unsafe search path, allowing a local attacker to place a malicious DLL
in a location searched before the legitimate library location. If
successfully exploited, an attacker with local write access to the affected
directory could achieve arbitrary code execution in the security context of
the GV-Remote E-Map process. |
| GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker. |
| GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root. |
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted. |
| GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. |
| GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
| GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service. |
