Hardcoded credentials

Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream...

CVE-2018-10328

Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream...

streaming-hentai.biz XSS vulnerability

Open Bug Bounty ID: OBB-606404 Description| Value ---|--- Affected Website:| streaming-hentai.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

streaming-beurette.net XSS vulnerability

Open Bug Bounty ID: OBB-606403 Description| Value ---|--- Affected Website:| streaming-beurette.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Media Streaming add-on, which handles the transmission of multimedia files, arises from the failure to eliminate special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the Media Streaming add-on relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands with root privileges remotely...

Streaming site 123movies has been shut down; here are its alternatives

By Waqas On March 19th, the world's most popular pirate streaming website 123movies This is a post from HackRead.com Read the original post: Streaming site 123movies has been shut down; here are its alternatives...

Suppressing the Adversary via Threat Hunt Teams

What a brave new world. Global cyber insurgencies continue unabated. Decreasing dwell time is imperative in 2018. In order to achieve this goal, we must embrace the hunt. Every organization should stand up a threat hunt team. The team must be multidisciplinary with experience in e-forensics and...

CVE-2014-2297

Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 n parameter to ls/htmlchat.php or 2 bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap...

CVE-2014-2297

CVE-2014-2297 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in the WordPress plugin VideoWhisper Live Streaming Integration (version 4.29.6 mentioned in the CVE description). Attackers can inject arbitrary script/HTML by manipulating the n parameter to ls/htmlchat.php or the bgcolo...

Wowza Streaming Engine Directory Traversal Vulnerability

Wowza Streaming Engine is a streaming media server software from Wowza Media Systems. The program supports live streaming, VOD, online video chat, and remote recording. A security vulnerability exists in com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine versions prior...

The vulnerability of the Libavcodec library, which is part of multimedia libraries like Ffmpeg, allows a hacker to execute arbitrary code.

The vulnerability of the Libavcodec library, which is part of multimedia libraries like Ffmpeg, exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using a specially created ASF file...

DEBIAN-CVE-2017-18236

An issue was discovered in Exempi before 2.4.4. The ASFSupport::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASFSupport.cpp allows remote attackers to cause a denial of service infinite loop via a crafted .asf file...

USN-3598-1 curl vulnerabilities

Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2018-1000120 Dario Weisser discovered that curl incorrectly handled certain LDAP URLs. An attacker could possibly use this issue t...

DEBIAN-CVE-2018-1000122

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage...

ALPINE-CVE-2018-1000122

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage...

RTSP RTP buffer over-read

curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be...

UBUNTU-CVE-2018-1000122

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage...

A Star Wars Analogy to Defend Against Non-Malware Attacks and the Dark Side

I like watching movies because I can relate almost anything in my real life to the movies I watched. Last week, I did a presentation at "Security Days Tokyo 2018," and I used Star Wars to describe the targeted attacks, non-malware attacks, AI-based, NGAV, etc. The Star Wars analogies were well...

How to Sysprep PVS images before they are streamed to Target Devices.

Question: Is needed to run Sysprep on PVS images? Answer: It is not needed to run Sysprep on PVS/MCS images since they both have their own version/method built-in to Sysprep the images. Also, it is not recommended to run Sysprep on PVS or MCS machines since it is not needed...

Media Streaming add-on cross-site scripting vulnerability

QNAP NAS application Media Streaming add-on is a video streaming loading application for QNAP NAS devices from QNAP Systems. A cross-site scripting vulnerability exists in QNAP NAS application Media Streaming add-on version 21.1.0.2 and earlier and version 430.1.2.0 and earlier. A remote attacker...