Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Mirasys Video Management System 路径遍历漏洞
Vulnerability Description
Mirasys Video Management System（VMS）是芬兰Mirasys公司的一套监控视频管理系统。 Mirasys VMS 7.6.1之前版本和8.3.2之前的8.x版本中存在路径遍历漏洞，该漏洞源于程序没有正确处理AutoUpdateService的Download()方法。攻击者可借助‘..’序列利用该漏洞下载感兴趣的系统文件，包括：SAM数据库备份文件和Web.config文件。
CVSS Information
N/A
Vulnerability Type
N/A