Junnosuke Kushibiki

Name of the Vulnerable Software and Affected Versions: PLANEX COMMUNICATIONS network cameras (affected versions not specified) Description: A cross-site scripting issue exists in the web management page of the network cameras. If a logged-in user accesses a specific file, an arbitrary script may be executed on the user's web browser. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A cross-site request forgery issue allows a remote unauthenticated attacker to alter user information. If the targeted user is an administrator, settings such as the administrator's ID, password, etc., may be altered.

A client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may lead to an arbitrary script execution on a logged-in user's web browser.

Missing authentication for a critical function exists in the affected data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication.

Cross-site request forgery (CSRF) allows a remote unauthenticated attacker to conduct an arbitrary operation by having a logged-in user view a malicious page.

An improper authentication issue in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user.