WordPress video carousel slider with lightbox plugin <= 1.0.6 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Ala Arfaoui in WordPress Plugin video carousel slider with lightbox versions = 1.0.6...

WordPress HTML5 Video Player plugin <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler vulnerability

Missing Authorization in multiple functions via h5vpajaxhandler vulnerability discovered by Lucio Sá in WordPress Plugin Flash & HTML5 Video versions = 2.5.32...

WordPress HTML5 Video Player plugin <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by Lucio Sá in WordPress Plugin Flash & HTML5 Video versions = 2.5.34...

CVE-2024-40658

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-10743 · WordPress · Video Carousel Slider With Lightbox Plugin

Name of the Vulnerable Software and Affected Versions: video carousel slider with lightbox plugin for WordPress versions 1.0.0 through 1.0.6 Description: The issue is related to SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient...

PT-2024-38534 · WordPress · Html5 Video Player – Mp4 Video Player Plugin

Name of the Vulnerable Software and Affected Versions: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress versions up to, and including, 2.5.34 Description: The issue is related to unauthorized modification of data due to a missing capability check on the save passwor...

WordPress plugin video carousel slider with lightbox SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the...

WordPress Flash & HTML5 Video Plugin <= 2.5.32 is vulnerable to Broken Access Control

Software Flash & HTML5 Video Type Plugin Vulnerable versions = 2.5.32 Fixed in 2.5.33 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7727 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b5ae27e206ad Credits Lucio Sá Required...

WordPress video carousel slider with lightbox Plugin <= 1.0.6 is vulnerable to SQL Injection

Software video carousel slider with lightbox Type Plugin Vulnerable versions = 1.0.6 Fixed in 1.0.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2019-25212 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 8ccaa8ef0272 Credits Ala Arfaoui Required privileg...

WordPress Flash & HTML5 Video Plugin <= 2.5.34 is vulnerable to Broken Access Control

Software Flash & HTML5 Video Type Plugin Vulnerable versions = 2.5.34 Fixed in 2.5.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7721 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 692106c3e036 Credits Lucio Sá Required...

Smart home security advice. Ring, SimpliSafe, Swann, and Yale

Introduction This guide covers the security of smart home security products from Ring, Yale, Swann, and SimpliSafe. Whether you're looking to monitor your property remotely, enhance your home's security, or see who’s at the front door, this guide will provide you with valuable insights. We have...

QNAP QTS Video Station Multiple Vulnerabilities (QSA-24-24)

QNAP Video Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qnap:videostation"; if...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that originates from the getConfig method in the SoftVideoDecoderOMXComponent.cpp file contains a heap buffer overflow that could result in an...

PT-2024-6186 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 23.6.6, 24.5 and earlier Description: The issue is related to an out-of-bounds write vulnerability in Adobe After Effects, which could result in arbitrary code execution in the context of the current user...

Mercury MNVR816 安全漏洞

Mercury MNVR816 is a network DVR from Mercury China. A security vulnerability exists in Mercury MNVR816 version 2.0.1.0.5 and prior versions. An attacker could exploit the vulnerability to access directories or files...

PT-2024-38536 · WordPress · Html5 Video Player

Name of the Vulnerable Software and Affected Versions: HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress versions up to, and including, 2.5.32 Description: The issue is related to unauthorized access of data due to a missing capability check on multiple functions called...

Fedora: Security Advisory (FEDORA-2024-6b8845e3f0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Lazarus Group Targets Blockchain Pros with Fake Video Conferencing, Job Scam

A new Group-IB report highlights an ongoing campaign by the North Korean Lazarus Group, known as the “Eager…...

Friday Squid Blogging: Live Video of Promachoteuthis Squid

The first live video of the Promachoteuthis squid, filmed at a newly discovered seamount off the coast of Chile. Blog moderation policy...

CVE-2023-47563

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later...