12844 matches found
CVE-2026-33319 AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
WWBN AVideo is an open source video platform. Prior to version 26.0, the uploadVideoToLinkedIn method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg. If an attacke...
CVE-2026-33292 AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint view/hls.php is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The videoDirectory GET parameter is used in two...
CVE-2026-33292
WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint view/hls.php is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The videoDirectory GET parameter is used in two...
CVE-2019-25603
TuneClone 2.20 contains a structured exception handler SEH buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious license code string. Attackers can craft a payload with a controlled buffer, NSEH jump instruction, and SEH handler address...
CVE-2026-4441
creationtimestamp| type| source ---|---|--- 2026-03-22 04:31:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhmpm3w6qi2u 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260324 2026-03-29 01:55:42+00:00|...
CVE-2026-4448
creationtimestamp| type| source ---|---|--- 2026-03-22 04:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhmnvf5btp25 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260324...
DEBIAN-CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...
CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...
UBUNTU-CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length only 12 digits instead of the 20 recommended...
CVE-2026-4446
creationtimestamp| type| source ---|---|--- 2026-03-22 03:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhmkl3iwrw2c 2026-03-24 01:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260324...
PT-2026-27008
Name of the Vulnerable Software and Affected Versions Flos Freeware Notepad2 version 4.2.25 Description A weakness exists in Flos Freeware Notepad2 4.2.25, impacting an unknown function within the TextShaping.dll library. Exploitation involves a manipulation that can lead to an uncontrolled searc...
PT-2026-26955
ZOC Terminal 7.23.4 contains a buffer overflow vulnerability in the Shell field of Program Settings that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a crafted payload into the Shell configuration field and trigger a crash when...
PT-2026-26962
Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.5 Description SOGo does not properly renew One-Time Passwords OTPs when a user disables and re-enables them. Additionally, the generated OTPs have a length of only 12 digits, which is shorter than the recommended 20...
CVE-2019-25547
NetAware 1.20 contains a buffer overflow vulnerability in the User Blocking feature that allows local attackers to crash the application by supplying oversized input. Attackers can paste a malicious buffer of 512 bytes into the 'Add a website or keyword to be filtered' field and trigger a crash...
CVE-2026-1313
creationtimestamp| type| source ---|---|--- 2026-03-21 06:39:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhkgcafysn2y 2026-03-21 10:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116266698540154784 2026-03-21 10:30:30+00:00| seen|...
CVE-2026-4261
creationtimestamp| type| source ---|---|--- 2026-03-21 06:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116265637003356030 2026-03-21 06:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mhke4iyr2y2c 2026-03-21 06:29:31+00:00| seen|...
CVE-2026-2941
creationtimestamp| type| source ---|---|--- 2026-03-21 03:17:13+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2941 2026-03-21 06:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhkgl6tcpc2k 2026-03-21 20:01:11+00:00| seen|...
CVE-2026-33238
WWBN AVideo is an open source video platform. Prior to version 26.0, the listFiles.json.php endpoint accepts a path POST parameter and passes it directly to glob without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by...
CVE-2026-33237 AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were...