HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Description The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks % time curl "https://example.com/?restroute=/h5vp/v1/video/1&id=1'+OR+SELECT+1+FROM+SELECTSLEEP5xyz--+-"...

WordPress FV Flowplayer Video Player Plugin <= 7.5.45.7212 is vulnerable to Cross Site Scripting (XSS)

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.45.7212 Fixed in 7.5.46.7212 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35631 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 55cedf8dbca9 Credits Dimas...

MAL-2024-1381 Malicious code in hydra-player-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7720f1989519eea97e5b9ed98d358af6284229910d3a7ca848cbde3d767908de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hydra-player-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7720f1989519eea97e5b9ed98d358af6284229910d3a7ca848cbde3d767908de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5205 Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode

The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojsvideo shortcode in all versions up to, and including, 1.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Videojs HTML5 Player Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)

Software Videojs HTML5 Player Type Plugin Vulnerable versions = 1.1.11 Fixed in 1.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5205 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9eab4c8d8c5e Credits Krzysztof Zając...

PT-2024-35105 · WordPress · Html5 Video Player

Name of the Vulnerable Software and Affected Versions: Videojs HTML5 Player plugin for WordPress versions up to, and including, 1.1.11 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's videojs video shortcode. This...

USN-6783-1: VLC vulnerabilities

It was discovered that VLC incorrectly handled certain media files. A remote attacker could possibly use this issue to cause VLC to crash, resulting in a denial of service, or potential arbitrary code execution...

Breakthrough for Solv Protocol: $1 Billion TVL, Now a Top 32 DeFi Player

By Uzair Amir New York City, May 22 – Solv Protocol, a unified yield and liquidity layer for major digital assets,… This is a post from HackRead.com Read the original post: Breakthrough for Solv Protocol: $1 Billion TVL, Now a Top 32 DeFi Player...

MAL-2024-1370 Malicious code in @ozon-fe/media-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f83f6ec5a227a2759eaf3a0f63b52ed88c790c3af44ea8bf3a9fa132d746220e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Radio Player < 2.0.74 - Missing Authorization

Description The Radio Player plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the renderplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to render arbitrary radio players...

Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

This Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension"...

GHSA-8C85-4RR5-CHR4 Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

This Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension"...

PT-2024-40352 · Ez Systems · Ez Publish Legacy +1

Name of the Vulnerable Software and Affected Versions: VideoJS versions prior to the version that fixes the XSS vulnerability eZ Publish Platform 5.4 eZ Publish Legacy 5.4 Description: The issue is related to an XSS vulnerability in the Flash-based video player of VideoJS, which is bundled in...

CVE-2024-4398

The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Radio Player versions = 2.0.73...

WordPress plugin HTML5 Audio Player 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

RHEL 5 : flash-plugin (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - flash-plugin: multiple code execution issues fixed in APSB17-07 CVE-2017-3003 - Adobe Flash Player versio...

CVE-2024-4398 HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-4398

CVE-2024-4398 affects the HTML5 Audio Player – Audio Player Plugin for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in the plugin’s widgets due to insufficient input sanitization and output escaping for user-supplied attributes, viable when an attacker has Contributor or hi...