Information disclosure

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

Information disclosure

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLwebpimage parameter...

CVE-2023-47171

CVE-2023-47171 affects WWBN AVideo 11.6 and the dev master (commit 15fed957fb). TALOS documents an information disclosure via the aVideoEncoder.json.php chunkFile path functionality, allowing an attacker to read arbitrary files by supplying a crafted chunkFile parameter in an HTTP request. The ad...

CVE-2023-47171

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-47171

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-47171

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-49863

WWBN AVideo vulnerability CVE-2023-49863 affects the aVideoEncoderReceiveImage.json.php image upload handler. The issue arises from the downloadURL_webpimage parameter, where an attacker can supply a URL that traverses the server’s filesystem (via /videos/.. paths) to read arbitrary files, includ...

CVE-2023-49862

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLgifimage parameter...

CVE-2023-49862

The CVE-2023-49862 issue affects WWBN AVideo (dev master, commit 15fed957fb) in the image upload helper objects/aVideoEncoderReceiveImage.json.php. The root cause is a server-side file read via image URL handling: the code allows arbitrary local file reads by constructing a local path from the po...

CVE-2023-49864

WWBN AVideo (dev master commit 15fed957fb) has an information disclosure vulnerability in the image upload path objects/aVideoEncoderReceiveImage.json.php. The issue is triggered by the downloadURL_image parameter and can lead to arbitrary file reads by abusing how the code fetches remote content...

CVE-2023-49864

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLimage parameter...

CVE-2023-49863

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLwebpimage parameter...

CVE-2023-49864

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLimage parameter...

CVE-2023-49863

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLwebpimage parameter...

CVE-2023-49738

The CVE-2023-49738 issue affects WWBN AVideo (image404Raw.php). Cisco Talos reports a information-disclosure vulnerability where the image parameter (or REQUEST_URI) is used to build a path to read local files, enabling arbitrary file read (e.g., reading videos/configuration.php, which could reve...

CVE-2023-49738

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-49738

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-48247

The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

Cross site request forgery (csrf)

The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48247

Summary: CVE-2023-48247 describes an unauthenticated remote exploit that allows reading arbitrary files under the application’s OS user (root) context via a crafted HTTP request. The vulnerability is documented across multiple feeds (NVD, Red Hat, CVE List) with a CVSSv3.1 base score of 7.5 (HIGH...