Mirasys Vms
Approved changes feed: RSS · Atom
cpe:2.3:a:mirasys:mirasys_vms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mirasys (80e2a259-8823-5b91-9ed5-5dffa4d91c0d) |
|---|---|
| Product | Mirasys Vms (7f03c88f-a6a5-50f5-a272-358d3dae85ed) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-11031 |
vulnerable | 2026-06-08 05:12:26.234653 |
Details available
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.
Published: 2019-08-22T14:52:18.000Z
Updated: 2024-08-04T22:40:15.975Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11030 |
vulnerable | 2026-06-08 05:12:26.234116 |
Details available
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
Published: 2019-08-22T14:51:12.000Z
Updated: 2024-08-04T22:40:15.979Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11029 |
vulnerable | 2026-06-08 05:12:26.233260 |
Details available
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.
Published: 2019-08-22T14:49:45.000Z
Updated: 2024-08-04T22:40:15.943Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.