PT-2025-36308

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where a kernel crash can occur due to trying to copy to unmapped memory. This happens when a program is streaming video and another program changes the...

CVE-2024-50266

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HWCTRLTRIGGER for vcodec GDSCs A recent change in the venus driver results in a stuck clock on the Lenovo ThinkPad X13s, for example, when streaming video in firefox: videoccmvs0clk status stuck at...

DEBIAN-CVE-2024-50266

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HWCTRLTRIGGER for vcodec GDSCs A recent change in the venus driver results in a stuck clock on the Lenovo ThinkPad X13s, for example, when streaming video in firefox: videoccmvs0clk status stuck at...

CVE-2024-50266

CVE-2024-50266 concerns the Linux kernel clk/qcom/videocc-sm8350 path where a venus driver change could cause a stuck vcodec clock (example: video_cc_mvs0_clk) on certain ThinkPad hardware. The issue is triggered by runtime control mode in GDSCs and was resolved by using HW_CTRL_TRIGGER for vcode...

Unauthorized Access Vulnerability in KingH5Stream of Beijing Asian Control Technology Development Co.

KingH5Stream is a live video streaming solution based on HTML5 technology. KingH5Stream by Beijing Asian Control Technology Development Co. Ltd. has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2024-51485 Insufficient Validation in Plugins (Activation/Deactivation) in Ampache

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...

CVE-2024-51486

Ampache (web-based audio/video streaming app and file manager) has a Stored Cross-Site Scripting vulnerability in the interface menu’s Custom URL - Favicon field. The input is not properly sanitized, allowing JavaScript execution. The issue is mitigated by upgrading to version 7.0.1, which is the...

CVE-2024-51489 Insufficient Message Token Validation in Ampache

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users send messages to one another. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to send messag...

CVE-2024-51489 Insufficient Message Token Validation in Ampache

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users send messages to one another. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to send messag...

CVE-2024-51489

Ampache (web-based audio/video streaming app and file manager) is affected by an insufficient CSRF token validation in its messaging feature. The root cause is the current token parsing/validation logic not adequately validating CSRF tokens when users send messages to one another, enabling potent...

CVE-2024-51490 Stored Cross-Site Scripting in Ampache

Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. Thi...

CVE-2024-47790

UNSUPPORTED WHEN ASSIGNED This vulnerability exists in D3D Security IP Camera D8801 due to usage of insecure Real-Time Streaming Protocol RTSP version for live video streaming. A remote attacker could exploit this vulnerability by crafting a RTSP packet leading to unauthorized access to live feed...

CVE-2024-47790 Missing Authorization Vulnerability

UNSUPPORTED WHEN ASSIGNED This vulnerability exists in D3D Security IP Camera D8801 due to usage of insecure Real-Time Streaming Protocol RTSP version for live video streaming. A remote attacker could exploit this vulnerability by crafting a RTSP packet leading to unauthorized access to live feed...

CVE-2024-47184

CVE-2024-47184 affects Ampache prior to version 6.6.0, where the Democratic Playlist Name is vulnerable to stored cross-site scripting. The issue is fixed in 6.6.0. Vulnerable component: Ampache web-based audio/video streaming application and file manager; root cause: stored XSS in Democratic Pla...

FFmpeg Buffer Overflow Vulnerability (CNVD-2024-29680)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version v.n6.1-3-g466799d4f5, which can be exploited by an attacker to execute arbitrary code via the avsamplessetsilence function in the...

Ffmpeg Denial of Service Vulnerability (CNVD-2024-28707)

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A denial of service vulnerability exists in FFmpeg version n6.1, which can be exploited by attackers to cause a denial of service...

CVE-2024-28853

Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting XSS vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of...

CVE-2024-28852

Ampache (web-based audio/video streaming and file manager) has multiple reflective XSS vulnerabilities affecting forms that use the rule variable. Exploitation could involve injecting payloads in queries (e.g., song, podcast) via the $rule parameter. The issue is fixed in version 6.3.1; upgrading...

CVE-2024-29026

Owncast (github.com/owncast/owncast) is affected by CVE-2024-29026 due to a lenient CORS policy in versions 0.1.2 and earlier, allowing cross-origin requests to read privileged information and potentially leak the admin password. The root cause is improper cross-origin access control, as describe...

CVE-2023-49236

A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci...