Barco
40 CVEs across 27 Barco products. Browse Barco vulnerabilities, severities, and proof-of-concept exploits.
Barco products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26978 | Medium | 6.1 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. The os_username para… |
CVE-2022-26977 | Medium | 6.1 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanit… |
CVE-2022-26976 | Medium | 5.4 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. Lack of input sanit… |
CVE-2022-26975 | High | 7.5 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication. |
CVE-2022-26974 | Medium | 6.1 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of input sanitization… |
CVE-2022-26973 | Medium | 5.3 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. By tweaking the lic… |
CVE-2022-26972 | Medium | 6.1 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL parameters are not… |
CVE-2022-26971 | Medium | 5.3 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be… |
CVE-2022-26233 | High | 7.5 | 2022-04-03 | Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive infor… |
CVE-2021-38142 | High | 8.8 | 2021-09-07 | Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote… |
CVE-2021-35482 | High | 7.8 | 2021-07-21 | An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution (with user… |
CVE-2020-17504 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17503 | High | 7.2 | 2021-01-08 | The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad… |
CVE-2020-17502 | High | 7.2 | 2021-01-08 | Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a… |
CVE-2020-17500 | Critical | 9.8 | 2021-01-07 | Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administrati… |
CVE-2020-28329 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor coul… |
CVE-2020-28334 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent W… |
CVE-2020-28333 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session… |
CVE-2020-28332 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent Wi… |
CVE-2020-28330 | Medium | 6.5 | 2020-11-24 | Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. Affected Version(s): 2.5.1.8. An attacker armed with hardcoded API credentials (r… |
CVE-2020-28331 | High | 7.5 | 2020-11-24 | Barco wePresent WiPG-1600W devices have Improper Access Control. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W device has an SSH daemon included… |
CVE-2019-18833 | Medium | 5.9 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared be… |
CVE-2019-18832 | High | 8.1 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button implements encryption at rest which uses… |
CVE-2019-18829 | High | 7.8 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on… |
CVE-2019-18825 | High | 7.5 | 2019-12-17 | Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements… |
CVE-2019-18824 | Medium | 6.6 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of t… |
CVE-2019-18831 | Medium | 5.3 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a tes… |
CVE-2019-18830 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of… |
CVE-2019-18828 | Medium | 6.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account (present for access via debug interfaces… |
CVE-2019-18827 | Medium | 5.9 | 2019-12-16 | On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is… |
CVE-2019-18826 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used t… |
CVE-2019-3930 | Critical | 9.8 | 2019-04-30 | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmwar… |
CVE-2019-3929 | Critical | 9.8 | 2019-04-30 | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmwar… |
CVE-2018-10943 | High | 7.5 | 2018-07-10 | An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3. Sending an arbitrary unexpected string to TCP port 7100… |
CVE-2017-9377 | High | 8.8 | 2017-10-30 | A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker wi… |
CVE-2017-12460 | Medium | 5.4 | 2017-10-30 | An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpape… |
CVE-2016-3152 | Critical | 9.8 | 2017-01-12 | Barco ClickShare CSC-1 devices with firmware before 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firmware imag… |
CVE-2016-3151 | High | 7.5 | 2017-01-12 | Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with fi… |
CVE-2016-3150 | Medium | 6.1 | 2017-01-12 | Cross-site scripting (XSS) vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with… |
CVE-2016-3149 | Critical | 9.8 | 2017-01-12 | Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code v… |