5343 matches found
node.js -- multiple vulnerabilities
Node.js reports: Denial of Service Vulnerability in HTTP/2 CVE-2018-7161 All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node server providing an http2 server to crash. This can be accomplished by interacting with t...
ALPINE-CVE-2018-1000301
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have...
Teradek T-RAX 7.3.2 (snapshot.cgi) Stream Disclosure
Teradek T-RAX 7.3.2 snapshot.cgi Stream Disclosure Vendor: Teradek, LLC Product web page: https://www.teradek.com Affected version: Firmware Version: 7.3.2 build 24453 Teradek Firmware Version 7.3.15 Summary: T-RAX is a high-density enterprise-grade H.264 platform that encodes, decodes, and strea...
RTSP bad headers buffer over-read
curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately an...
Hardcoded credentials
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream...
CVE-2018-10328
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream...
streaming-beurette.net XSS vulnerability
Open Bug Bounty ID: OBB-606403 Description| Value ---|--- Affected Website:| streaming-beurette.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
streaming-hentai.biz XSS vulnerability
Open Bug Bounty ID: OBB-606404 Description| Value ---|--- Affected Website:| streaming-hentai.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Media Streaming add-on Command Injection
The vulnerability of the Media Streaming add-on relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands with root privileges remotely...
Streaming site 123movies has been shut down; here are its alternatives
By Waqas On March 19th, the world's most popular pirate streaming website 123movies This is a post from HackRead.com Read the original post: Streaming site 123movies has been shut down; here are its alternatives...
Suppressing the Adversary via Threat Hunt Teams
What a brave new world. Global cyber insurgencies continue unabated. Decreasing dwell time is imperative in 2018. In order to achieve this goal, we must embrace the hunt. Every organization should stand up a threat hunt team. The team must be multidisciplinary with experience in e-forensics and...
CVE-2014-2297
Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 n parameter to ls/htmlchat.php or 2 bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap...
CVE-2014-2297
CVE-2014-2297 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in the WordPress plugin VideoWhisper Live Streaming Integration (version 4.29.6 mentioned in the CVE description). Attackers can inject arbitrary script/HTML by manipulating the n parameter to ls/htmlchat.php or the bgcolo...
PT-2018-4197
Name of the Vulnerable Software and Affected Versions VideoWhisper Live Streaming Integration plugin version 4.29.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the n parameter to...
CVE-2014-2297: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 n parameter to ls/htmlchat.php or 2 bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap...
Wowza Streaming Engine Directory Traversal Vulnerability
Wowza Streaming Engine is a streaming media server software from Wowza Media Systems. The program supports live streaming, VOD, online video chat, and remote recording. A security vulnerability exists in com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine versions prior...
Libavcodec Code Execution
The vulnerability of the Libavcodec library, which is part of multimedia libraries like Ffmpeg, exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using a specially created ASF file...
DEBIAN-CVE-2017-18236
An issue was discovered in Exempi before 2.4.4. The ASFSupport::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASFSupport.cpp allows remote attackers to cause a denial of service infinite loop via a crafted .asf file...
USN-3598-1 curl vulnerabilities
Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2018-1000120 Dario Weisser discovered that curl incorrectly handled certain LDAP URLs. An attacker could possibly use this issue t...
DEBIAN-CVE-2018-1000122
A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage...