{"id":"CVE-2026-103098","state":"PUBLISHED","title":"GV-Eye Sensitive information exposure in URL query parameter Vulnerability","description":"Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.  The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key","publishedAt":"2026-10-02T00:15:17.848Z","updatedAt":"2026-10-02T18:19:15.437Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GV"},"assigner":"GV","products":["GeoVision Inc. GV-Eye"],"affected":[{"vendor":"GeoVision Inc.","product":"GV-Eye","packageName":"tw.com.geovision.gveye","defaultStatus":"unaffected","versions":[{"version":"V3.6.0","status":"affected"},{"version":"V3.7.2","status":"unaffected"}],"platforms":["Android"]}],"references":["https://www.geovision.com.tw/cyber_security.php"],"weaknesses":["CWE-319"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103098.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103098","state":"PUBLISHED","datePublished":"2026-10-02T00:15:17.848Z","dateUpdated":"2026-10-02T18:19:15.437Z","assignerShortName":"GV","assignerOrgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateReserved":"2026-09-30T02:10:02.128Z"},"containers":{"cna":{"title":"GV-Eye Sensitive information exposure in URL query parameter Vulnerability","descriptions":[{"lang":"en","value":"Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.  The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key"}],"affected":[{"vendor":"GeoVision Inc.","product":"GV-Eye","packageName":"tw.com.geovision.gveye","defaultStatus":"unaffected","versions":[{"version":"V3.6.0","status":"affected"},{"version":"V3.7.2","status":"unaffected"}],"platforms":["Android"]}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","lang":"en","description":"CWE-319 Cleartext transmission of sensitive information","type":"CWE"}]}],"providerMetadata":{"shortName":"GV","orgId":"0df08a0e-a200-4957-9bb0-084f562506f9","dateUpdated":"2026-10-02T00:15:17.848Z"},"datePublic":"2026-09-30T02:15:00.000Z","impacts":[{"capecId":"CAPEC-158","descriptions":[{"lang":"en","value":"CAPEC-158 Sniffing Network Traffic"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:geovision_inc.:gv-eye:v3.6.0:*:android:*:*:*:*:*"},{"vulnerable":false,"criteria":"cpe:2.3:a:geovision_inc.:gv-eye:v3.7.2:*:android:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Lloyd Lexter Gealon","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-02T18:19:07.251183Z","id":"CVE-2026-103098","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-02T18:19:15.437Z"}}]}}}