Vulnerabilidades de Sony
CVEs publicadas que afetam produtos de Sony: 10 registro(s), com severidade, exploração e correções.
Bravia Signage 3Snc-cx600w Firmware 2Optical Disc Archive Software for Windows 2SNC-CX600W 2Snc-dh120t Firmware 1INZONE Hub 1PS4 1
CVE-2026-50255
Média · 6.7
CWE-276 16/06/2026
Incorrect Default Permissions em Sony Optical Disc Archive Software for Windows
Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. If this vulnerability is exploited, arbitrary code may be executed with SYSTEM privileges.
CVE-2025-64390
Alta · 7.4
CWE-367 02/06/2026
TOCTOU Race Condition em Sony PS4
A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file.
CVE-2020-36924
Média · 6.1
CWE-829 06/01/2026
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion
Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.
CVE-2020-36923
Crítica · 9.8
CWE-639 06/01/2026
Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR
Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.
CVE-2020-36922
Alta · 7.5
CWE-497 06/01/2026
Sony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information Disclosure
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.
CVE-2020-36885
Crítica · 9.8
CWE-787 10/12/2025
Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality, potentially causing remote code execution or denial of service.
CVE-2025-64772
Alta · 7.8
CWE-427 30/11/2025
Uncontrolled Search Path Element em Sony INZONE Hub
The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
CVE-2025-64730
Média · 6.1
CWE-79 25/11/2025
Cross-site Scripting (XSS) em Sony Snc-cx600w Firmware
Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product.
CVE-2025-62497
Média · 6.5
CWE-352 25/11/2025
Cross-Site Request Forgery (CSRF) em Sony Snc-cx600w Firmware
Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed.
CVE-2025-62225
Média · 6.7
CWE-428 05/11/2025
Optical Disc Archive Software provided by Sony Corporation registers a Windows service…
Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.