Full title: Schneider Electric Pelco VideoXpert Missing Encryption Vulnerability 
Category: web applications
Platform: windows
Schneider Electric Pelco VideoXpert transmits sensitive data using double Base64 encoding for the Cookie 'auth_token' in a communication channel that can be sniffed by unauthorized actors or arbitrarily be read from the vxcore log file directly using directory traversal attack resulting in authentication bypass / session hijacking.

# 0day.today @ http://0day.today/