Lucene search

K

Avideo Security Vulnerabilities

cve
cve

CVE-2023-49863

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURL_webpimage...

6.5CVSS

6.8AI Score

0.001EPSS

2024-01-10 04:15 PM
11
cve
cve

CVE-2023-49864

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURL_image...

6.5CVSS

6.8AI Score

0.001EPSS

2024-01-10 04:15 PM
11
cve
cve

CVE-2023-50172

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any...

5.3CVSS

5.6AI Score

0.0004EPSS

2024-01-10 04:15 PM
9
cve
cve

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

8.8CVSS

9.2AI Score

0.001EPSS

2024-01-10 04:15 PM
9
cve
cve

CVE-2023-49599

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline,....

9.8CVSS

9.3AI Score

0.0004EPSS

2024-01-10 04:15 PM
17
cve
cve

CVE-2023-49738

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file...

7.5CVSS

7.6AI Score

0.001EPSS

2024-01-10 04:15 PM
11
cve
cve

CVE-2023-49589

An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this...

8.8CVSS

9AI Score

0.001EPSS

2024-01-10 04:15 PM
7
cve
cve

CVE-2023-49810

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a...

7.3CVSS

6.5AI Score

0.001EPSS

2024-01-10 04:15 PM
13
cve
cve

CVE-2023-49862

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURL_gifimage...

6.5CVSS

6.8AI Score

0.001EPSS

2024-01-10 04:15 PM
12
cve
cve

CVE-2023-48730

A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

8.5CVSS

6.2AI Score

0.001EPSS

2024-01-10 04:15 PM
13
cve
cve

CVE-2023-48728

A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

9.6CVSS

6.2AI Score

0.001EPSS

2024-01-10 04:15 PM
9
cve
cve

CVE-2023-47862

A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this...

9.8CVSS

9.3AI Score

0.003EPSS

2024-01-10 04:15 PM
17
cve
cve

CVE-2023-47861

A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

9CVSS

5.6AI Score

0.001EPSS

2024-01-10 04:15 PM
6
cve
cve

CVE-2023-47171

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file...

6.5CVSS

6.4AI Score

0.0005EPSS

2024-01-10 04:15 PM
8
cve
cve

CVE-2023-32073

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to...

8.8CVSS

8.9AI Score

0.003EPSS

2023-05-12 02:15 PM
14
cve
cve

CVE-2023-30860

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

8CVSS

5.3AI Score

0.001EPSS

2023-05-08 07:15 PM
22
cve
cve

CVE-2023-30854

AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version...

8.8CVSS

8.6AI Score

0.003EPSS

2023-04-28 04:15 PM
20
cve
cve

CVE-2023-25313

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link...

9.8CVSS

9.6AI Score

0.004EPSS

2023-04-25 04:15 PM
16
cve
cve

CVE-2023-25314

Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to...

6.1CVSS

6AI Score

0.0005EPSS

2023-04-25 04:15 PM
14
cve
cve

CVE-2022-32778

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...

7.5CVSS

7.3AI Score

0.002EPSS

2022-08-22 07:15 PM
30
3
cve
cve

CVE-2022-32572

An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

8.8CVSS

8.9AI Score

0.013EPSS

2022-08-22 07:15 PM
33
9
cve
cve

CVE-2022-32282

An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased...

8.8CVSS

8.6AI Score

0.001EPSS

2022-08-22 07:15 PM
25
7
cve
cve

CVE-2022-32777

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the...

7.5CVSS

7.2AI Score

0.002EPSS

2022-08-22 07:15 PM
26
5
cve
cve

CVE-2022-32770

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger.....

6.1CVSS

6.1AI Score

0.001EPSS

2022-08-22 07:15 PM
39
4
cve
cve

CVE-2022-32772

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger.....

6.1CVSS

6.1AI Score

0.001EPSS

2022-08-22 07:15 PM
40
3
cve
cve

CVE-2022-33148

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

8.8CVSS

8.9AI Score

0.001EPSS

2022-08-22 07:15 PM
25
5
cve
cve

CVE-2022-34652

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

8.8CVSS

8.9AI Score

0.001EPSS

2022-08-22 07:15 PM
30
7
cve
cve

CVE-2022-32761

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this...

6.5CVSS

6.4AI Score

0.001EPSS

2022-08-22 07:15 PM
37
7
cve
cve

CVE-2022-30605

A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this...

8.8CVSS

8.6AI Score

0.002EPSS

2022-08-22 07:15 PM
23
7
cve
cve

CVE-2022-33149

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite...

8.8CVSS

8.9AI Score

0.001EPSS

2022-08-22 07:15 PM
33
7
cve
cve

CVE-2022-33147

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder...

8.8CVSS

8.9AI Score

0.001EPSS

2022-08-22 07:15 PM
41
7
cve
cve

CVE-2022-32771

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger.....

6.1CVSS

6AI Score

0.001EPSS

2022-08-22 07:15 PM
33
3
cve
cve

CVE-2022-30690

A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this.....

6.1CVSS

6.2AI Score

0.006EPSS

2022-08-22 07:15 PM
34
7
cve
cve

CVE-2022-32768

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP...

4.2CVSS

4.8AI Score

0.001EPSS

2022-08-22 07:15 PM
36
6
cve
cve

CVE-2022-32769

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP...

5CVSS

5.3AI Score

0.001EPSS

2022-08-22 07:15 PM
27
7
cve
cve

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this...

6.5CVSS

6.4AI Score

0.001EPSS

2022-08-22 07:15 PM
31
7
cve
cve

CVE-2022-28712

A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger...

9CVSS

8.5AI Score

0.001EPSS

2022-08-22 07:15 PM
38
7
cve
cve

CVE-2022-29468

A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this...

8.8CVSS

8.5AI Score

0.002EPSS

2022-08-22 07:15 PM
33
6
cve
cve

CVE-2022-30534

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

8.8CVSS

8.9AI Score

0.018EPSS

2022-08-22 07:15 PM
37
7
cve
cve

CVE-2022-26842

A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP...

9.6CVSS

8.6AI Score

0.002EPSS

2022-08-22 07:15 PM
47
7
cve
cve

CVE-2022-30547

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

9.9CVSS

9.6AI Score

0.001EPSS

2022-08-22 07:15 PM
36
6
cve
cve

CVE-2022-27462

Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to...

6.1CVSS

5.9AI Score

0.001EPSS

2022-04-05 04:15 PM
57
cve
cve

CVE-2022-27463

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login...

6.1CVSS

6.1AI Score

0.001EPSS

2022-04-05 04:15 PM
66
cve
cve

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

8.8CVSS

8.4AI Score

0.001EPSS

2021-02-01 04:15 PM
17
2
cve
cve

CVE-2020-23489

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to...

8.8CVSS

8.7AI Score

0.001EPSS

2020-11-16 06:15 PM
42
cve
cve

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd...

7.5CVSS

7.2AI Score

0.003EPSS

2020-11-16 06:15 PM
22