9.4

CVE-2008-5674

Exploit
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Darkwet ≫ Webcam Xp Version <= 3.72.440.0
Darkwet ≫ Webcam Xp Version1.02.432
Darkwet ≫ Webcam Xp Version1.02.535
Darkwet ≫ Webcam Xp Version1.6.945
Darkwet ≫ Webcam Xp Version2.20
Darkwet ≫ Webcam Xp Version3.72
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.51% 0.903
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.4 10 9.2
AV:N/AC:L/Au:N/C:C/I:N/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://aluigi.altervista.org/adv/webcamxp-adv.txt
http://osvdb.org/42929
http://secunia.com/advisories/29007
Vendor Advisory
http://securityreason.com/securityalert/4788
http://www.osvdb.org/42927
http://www.osvdb.org/42928
http://www.securityfocus.com/archive/1/488364/100/200/threaded
http://www.securityfocus.com/bid/27875
Exploit