CVE-2022-23427

PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission via implicit Intent...

Google Android 输入验证错误漏洞

Google Android is a Linux-based open source operating system from Google. An input validation error vulnerability exists in Google Android, which can be exploited by a local attacker to gain unauthorized access to media files in KnoxPrivacyNoticeReceiver via an implicit intent...

Huawei HarmonyOS Access Control Error Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS, which provides a microkernel-based, full-scenario distributed operating system. The vulnerability can be exploited to read/write media files in a non-distributed directory ...

CVE-2021-37023

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads and writes in non-distributed directories on any device on the network...

Improper access control

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads and writes in non-distributed directories on any device on the network...

CVE-2021-37023

CVE-2021-37023 concerns Huawei HarmonyOS/Huawei smartphones. Multiple connected sources describe an Improper Access Control vulnerability that allows reading and writing media files in non-distributed directories across devices on the network. Root cause identified as access-control weaknesses in...

CVE-2021-37023

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files which can be reads and writes in non-distributed directories on any device on the network...

TYPO3 Licensing Issue Vulnerability (CNVD-2022-17968)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 has a licensing issue vulnerability that stems from a breach of access control in the extension-bound media browser, which could be exploited by an attacker to execute a request to th...

CVE-2021-43563

An issue was discovered in the pixxio aka pixx.io integration or DAM extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to...

CVE-2021-43563

CVE-2021-43563 affects the TYPO3 extension pixx.io integration (DAM) prior to version 1.0.6. The issue is a broken Access Control in the bundled media browser, allowing an unauthenticated attacker to make requests to the pixx.io API using the configured API user and download media files from the ...

CVE-2021-24816

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own...

Buffer overflow

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own...

CVE-2021-24816

The CVE-2021-24816 entry concerns the WordPress plugin Phoenix Media Rename (versions prior to 3.4.4). The underlying issue is missing capability checks in the phoenix_media_rename AJAX action, allowing users with Author roles to rename any uploaded media files, including those they do not own. I...

GetId3 跨站脚本漏洞

GetId3 is used to extract useful information from Mp3 or other media files. A cross-site scripting vulnerability in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

GPAC Heap Buffer Overflow Vulnerability (CNVD-2021-82978)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. a heap buffer overflow vulnerability exists in the ODReadUTF8String function in odfcode.c in GPAC version 0.8.0. An attacker could exploit the vulnerability to cause a denial of service via specially crafted...

GPAC Heap Buffer Overflow Vulnerability (CNVD-2021-82980)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. stblGetSampleSize function in isomedia/stblread.c in GPAC version 0.8.0 is vulnerable to a heap buffer overflow. An attacker could exploit this vulnerability to cause a denial of service via specially crafted...

GPAC Heap Buffer Overflow Vulnerability (CNVD-2021-82979)

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. gfhintertrackprocess function in isomhintertrackprocess.c in GPAC version 0.8.0 is vulnerable to a heap buffer overflow. An attacker can exploit this vulnerability to cause a denial of service via specially...

GPAC 缓冲区错误漏洞

GPAC is a multimedia framework for rich media and is distributed under the LGPL license. stblGetSampleSize function in isomedia/stblread.c in GPAC version 0.8.0 is vulnerable to a heap buffer overflow. An attacker could exploit this vulnerability to cause a denial of service via specially crafted...

Cross-Site Scripting via SVG media files

Impact Cross-Site Scripting via SVG media files Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...

Shopware Cross-Site Scripting Vulnerability (CNVD-2021-94930)

Shopware is an open source e-commerce software. cross-site scripting vulnerability exists in versions of Shopware prior to 6.4.3.1. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via SVG media files...