ROS-20240402-13

Vulnerability in picparameterset::dump function of h.265 Libde265 video codec implementation is related to multiple buffer overflows via numtilecolumns and numtilerow parameters. Exploitation of the of the vulnerability could allow an attacker acting remotely to cause a denial of service...

PT-2024-6580 · Hikvision · Hikvision Ds-7604Ni-K1/4P +1

Name of the Vulnerable Software and Affected Versions: Hikvision NVRs affected versions not specified Hikvision DS-7604NI-K1/4PB affected versions not specified Description: The issue is related to a NULL dereference pointer vulnerability. It is caused by insufficient validation of a parameter in...

CVE-2024-31106 WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yooslider Yoo Slider allows Reflected XSS.This issue affects Yoo Slider: from n/a through 2.1.1...

CVE-2024-31106 WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yooslider Yoo Slider allows Reflected XSS.This issue affects Yoo Slider: from n/a through 2.1.1...

CVE-2024-30437 WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3...

CVE-2024-30437

CVE-2024-30437 affects WPPOOL Webinar and Video Conference with Jitsi Meet: Improper neutralization of input in web page generation leads to Stored XSS. Affected: Webinar and Video Conference with Jitsi Meet from n/a through version 2.6.3. No exploitation status or patch details are provided in t...

CVE-2024-30437 WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3...

WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Yoo Slider versions = 2.1.1...

WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Responsive Image Gallery, Gallery Album versions = 2.0.3...

PT-2024-23365 · Unknown · Wppool Webinar/Video Conference With Jitsi Meet

Name of the Vulnerable Software and Affected Versions: WPPOOL Webinar and Video Conference with Jitsi Meet versions n/a through 2.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS...

Ampache Storage Cross-Site Scripting Vulnerability

Ampache is a web-based audio/video application and file manager. A cross-site scripting vulnerability exists in Ampache 6.2.1 and earlier versions, which stems from the lack of effective filtering and escaping of user-supplied data in /preferences.php?action=adminupdatepreferences, which can be...

PT-2024-41409 · Ооо "Ивс" · Videograce

Уязвимость программного обеспечения видеоконференцсвязи VideoGrace связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Ampache Cross-Site Scripting Vulnerability (CNVD-2024-15737)

Ampache is a web-based audio/video application and file manager. A cross-site scripting vulnerability exists in Ampache 6.2.1 and earlier versions, which stems from a lack of effective filtering and escaping of user-supplied data by the rule, and can be exploited by an attacker to execute arbitra...

PT-2024-41408 · Ооо "Ивс" · Videograce

Уязвимость программного обеспечения видеоконференцсвязи VideoGrace связана с недостаточной проверкой прав доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо создать учётную запись пользователя на сервере путём отправки специально сформированного POST-запроса...

WordPress Plugin Webinar and Video Conference with Jitsi Meet 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-29882

SRS is a simple, high-efficiency, real-time video server. SRS's /api/v1/vhosts/vid-?callback= endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS Cross-Site Scripting. This vulnerability is fixed in 5.0.210 and 6.0.121...

CVE-2024-29882

CVE-2024-29882 affects SRS (simple, high-efficiency real-time video server). The vulnerability lies in the /api/v1/vhosts/vid-?callback= endpoint, where the callback name was not filtered, enabling injection of malicious JavaScript and XSS. Multiple connected sources corroborate that the issue ma...

CVE-2024-29882 SRS DOM - XSS on JSONP callback

SRS is a simple, high-efficiency, real-time video server. SRS's /api/v1/vhosts/vid-?callback= endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS Cross-Site Scripting. This vulnerability is fixed in 5.0.210 and 6.0.121...

CVE-2024-29882 SRS DOM - XSS on JSONP callback

SRS is a simple, high-efficiency, real-time video server. SRS's /api/v1/vhosts/vid-?callback= endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS Cross-Site Scripting. This vulnerability is fixed in 5.0.210 and 6.0.121...

PT-2024-20337 · WordPress · The Ultimate Video Player

Name of the Vulnerable Software and Affected Versions: The Ultimate Video Player For WordPress versions prior to 2.2.3 Description: The issue is related to a lack of proper capability check when updating settings via a REST route, allowing users with Contributor and above roles to update them...