CVE-2022-36249: Authentication Bypass Using an Alternate Path or Channel

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API...

CVE-2022-36246: Undefined Security Weakness

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions...

PT-2023-13466 · Unknown · Shop Beat Media Player

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Description: The issue allows bypassing 2FA via APIs, specifically for Controlpanel Lite. After logging in, it is possible to use the bearer token or jsession ID to access APIs without...

PT-2023-13463 · Unknown · Shop Beat Media Player

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS vulnerabilities. These vulnerabilities can be exploited via the Shop Beat Control Panel, which is accessible at...

CVE-2022-36250: Cross-Site Request Forgery (CSRF)

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...

Shop Beat path traversal vulnerability

Shop Beat is a media player from Shop Beat, Inc. A path traversal vulnerability exists in Shop Beat Media Player versions 2.5.95 through 3.2.57, which stems from information in Shop Beat's studio software that can be exposed via a directory traversal vulnerability...

PT-2023-13467 · Unknown · Shop Beat Media Player

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Description: The issue concerns a Cross Site Request Forgery CSRF problem. This means an attacker could potentially trick a user into performing unintended actions on a web application tha...

CVE-2022-36244 Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...

CVE-2022-36244

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting XSS vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za...

CVE-2022-36247

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za...

CVE-2022-36250

Shop Beat Solutions Pty LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery CSRF...

iTunes Privilege Escalation

The vulnerability of the multimedia player iTunes is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-33931

Cross-Site Request Forgery CSRF vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.4 versions...

CVE-2023-33931

Cross-Site Request Forgery CSRF vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.4 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.4 versions...

CVE-2023-33931

CVE-2023-33931: Cross-Site Request Forgery in the YouTube Playlist Player WordPress plugin (≤ 4.6.4). Root cause: CSRF in the plugin enables unauthorized actions; impact variants described in public sources. Affected: YouTube Playlist Player plugin for WordPress. Remediation: update to 4.6.5 or l...

PT-2023-24577 · Unknown · Ciprian Popescu Youtube Playlist Player

Name of the Vulnerable Software and Affected Versions: Ciprian Popescu YouTube Playlist Player plugin versions prior to 4.6.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended...

CVE-2023-33931: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Ciprian Popescu YouTube Playlist Player plugin = 4.6.4 versions...

Cisco Webex Network Recording Player (cisco-sa-webex-player-rCFDeVj2)

The version of Cisco Webex Network Recording Player and Cisco Webex Player installed on the remote host is affected by a memory corruption vulnerability due to insufficient validation of Webex recording files formatted as either Advanced Recording Format ARF or Webex Recording Format WRF. An...

WordPress YouTube Playlist Player Plugin <= 4.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software YouTube Playlist Player Type Plugin Vulnerable versions = 4.6.4 Fixed in 4.6.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-33931 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 07d0f46aa846 Credits Skalucy...