CVE-2019-7656: Incorrect Permission Assignment for Critical Resource

A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/ core program files. By injecting a payload into one of those files...

CVE-2019-7655: Improper Neutralization of Input During Web Page Generation

Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the 1 customList%5B0%5D.value field in enginemanager/server/serversetup/editadv.htm of the Server Setup configuration or the 2 host field in enginemanager/jspringsecuritycheck of the login form. This issu...

CVE-2019-7654: Cross-Site Request Forgery (CSRF)

Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server-Users component. This issue w...

CVE-2018-19365

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request...

CVE-2018-19365

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request...

Design/Logic Flaw

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request...

CVE-2018-19365

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request...

CVE-2018-19365

Wowza Streaming Engine 4.7.4.01 REST API is vulnerable to directory-traversal, allowing remote attackers to read arbitrary files via crafted HTTP requests. Root cause: insufficient validation in the REST API path enables traversal of the server’s directory structure. Impact: potential unauthorize...

PT-2019-9793 · Wowza · Wowza Streaming Engine

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine version 4.7.4.01 Description: The issue allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. This is related to the REST API in Wowza Streaming Engine...

CVE-2018-19365: Improper Limitation of a Pathname to a Restricted Directory

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request...

Wowza Streaming Engine Directory Traversal Vulnerability

Wowza Streaming Engine is a streaming media server software from Wowza Media Systems. The program supports live streaming, VOD, online video chat, and remote recording. A security vulnerability exists in com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine versions prior...

CVE-2017-16922

In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request...

Design/Logic Flaw

In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request...

CVE-2017-16922

In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request...

CVE-2017-16922

Vulnerability in Wowza Streaming Engine (com.wowza.wms.timedtext.http.HTTPProviderCaptionFile) allows directory traversal and file retrieval via a remote HTTP request, affecting versions before 4.7.1. The root cause is the HTTPProviderCaptionFile’s handling of crafted requests that enables path t...

PT-2018-6365

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions prior to 4.7.1 Description: The issue allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. Recommendations: For versions prior to 4.7.1, update to...

CVE-2017-16922: Improper Limitation of a Pathname to a Restricted Directory

In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request...

Wowza Streaming Engine Cross-Site Scripting Vulnerability

Wowza Streaming Engine is a Unified Streaming Media Server software developed by Wowza Media Systems. A cross-site scripting vulnerability exists in Wowza Streaming Engine. An attacker can exploit this vulnerability via a specially crafted HTTP request to cause script injection...

Wowza Streaming Engine Denial of Service Vulnerability

Wowza Streaming Engine is a Unified Streaming Media Server software developed by Wowza Media Systems. A denial of service vulnerability exists in Wowza Streaming Engine. An attacker can exploit this vulnerability to cause a denial of service memory consumption via a specially crafted HTTP request...

Wowza Streaming Engine File System Read/Write Vulnerability

Wowza Streaming Engine is a Unified Streaming Media Server software developed by Wowza Media Systems. A file system read and write vulnerability exists in Wowza Streaming Engine. An attacker can read and write to the file system via JMX using default JMX credentials remote code execution is also...