CVE-2023-41288

CVE-2023-41288 is an OS command injection vulnerability affecting QNAP Video Station. Multiple connected sources confirm the flaw allows an attacker to execute commands over the network via Video Station’s interface. Impacted products/versions are Video Station prior to 5.7.2; the issue is addres...

CVE-2023-41288 Video Station

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

CVE-2023-6493

The Depicter Slider WordPress plugin (Averta Depicter Slider) is vulnerable to Cross-Site Request Forgery in all versions up to 2.0.6 due to missing/incorrect nonce validation on the save function. Unauthenticated attackers can modify plugin settings by tricking an administrator into performing a...

Easy Video Player < 1.2.2.11 - Contributor+ Stored XSS

Description The plugin does not validate and escape the ratiocode attribute of its evpembedvideo shortcode before outputting it back in a page where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

QNAP Systems Video Station SQL Injection Vulnerability

QNAP Systems Video Station is a video management and playback application from QNAP Systems. The SQL injection vulnerability, which previously existed in QNAP Systems Video Station version 5.7.2 2023/11/23 , stems from the presence of a SQL injection vulnerability that could allow a user to injec...

QNAP Systems Video Station Operating System Command Injection Vulnerability

QNAP Systems Video Station is a video management and playback application from QNAP Systems. An operating system command injection vulnerability exists in QNAP Systems Video Station prior to version 5.7.2 2023/11/23 , which stems from the presence of an operating system command injection...

Command Execution Vulnerability in HZ Video Security Exchange Access System of Hangzhou HZ Data Technology Co.

Ltd. "HZD", founded in 2003, is a high-tech company specializing in R&D, production and sales in the field of data security and big data. A command execution vulnerability exists in the Hopscotch Video Security Exchange Access System of Hangzhou Hopscotch Data Technology Co., Ltd, which can be...

UBUNTU-CVE-2023-46929

An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gfavcchangevui /afltest/gpac/src/mediatools/avparsers.c:6872:55 allows attackers to crash the application...

SUSE SLED15: gstreamer-plugins-bad / gstreamer-plugins-bad-chromaprint / etc (SUSE-SU-2024:0005-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0005-1 advisory. - CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free bsc1217213. - CVE-2023-40475: Fixed GStreame...

Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation

The Mozilla Foundation Security Advisory describes this flaw as: The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox...

gstreamer: MXF demuxer use-after-free vulnerability

A use-after-free flaw was found in the MXF demuxer in GStreamer when handling certain MXF video files. This issue could allow a malicious third party to trigger a crash in the application and may allow code execution...

Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation

The Mozilla Foundation Security Advisory describes this flaw as: The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox...

Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation

The Mozilla Foundation Security Advisory describes this flaw as: The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox...

RHEL 9 : firefox (RHSA-2024:0025)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0025 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2023-6485

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

CVE-2023-6485

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

Cross site scripting

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

CVE-2023-6485 Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

CVE-2023-6485

The CVE-2023-6485 entry concerns the Html5 Video Player WordPress plugin, affected in versions before 2.5.19. Root cause: the plugin does not sufficiently sanitize/escape some player settings and lacks proper capability checks. This enables Stored Cross-Site Scripting by authenticated users (e.g....

WordPress Plugin Html5 Video Player Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...