17173 matches found
CVE-2023-49810
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a seri...
CVE-2023-50172
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user...
CVE-2023-49810
Summary (validated from provided sources) : CVE-2023-49810 affects WWBN AVideo (dev master commit 15fed957fb). A weakness in checkLoginAttempts can bypass the captcha protection, enabling brute-force login attempts via a sequence of HTTP requests. Talos confirms the vulnerability in the login flo...
CVE-2023-48260
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48261
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48260
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48258
The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’s session...
CVE-2023-48259
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48256
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request...
CVE-2023-48255
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log...
CVE-2023-48256
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request...
CVE-2023-48254
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...
CVE-2023-48254
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...
Cross site request forgery (csrf)
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
Code injection
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log...
Cross site request forgery (csrf)
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request...
Cross site request forgery (csrf)
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48261
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request...
CVE-2023-48261
CVE-2023-48261 affects Bosch Nexo/Nexo-OS devices (from Bosch PSIRT and related sources). The vulnerability allows a remote unauthenticated attacker to read arbitrary content from the results database via a crafted HTTP request, implying an injection/query handling weakness in the affected compon...
