USN-6403-3: libvpx vulnerabilities

USN-6403-1 fixed several vulnerabilities in libvpx. This update provides the corresponding update for Ubuntu 16.04 LTS. Original advisory details: It was discovered that libvpx did not properly handle certain malformed media files. If an application using libvpx opened a specially crafted file, a...

PT-2023-8660 · Cisco · Cisco Meeting Server

Name of the Vulnerable Software and Affected Versions: Cisco Meeting Server affected versions not specified Description: The issue is related to insufficient validation of HTTP requests in the Web Bridge feature of Cisco Meeting Server, which could allow an unauthenticated, remote attacker to cau...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

Code injection

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. PrestaShop themevolty v.4.0.8 version before the security vulnerability , the vulnerability stems from through...

SUSE SLED15: gstreamer-plugins-bad / gstreamer-plugins-bad-chromaprint / etc (SUSE-SU-2023:4271-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4271-1 advisory. - CVE-2023-40474: Fixed a remote code execution issue due to improper parsing of H265 encoded video files bsc1215793...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

CVE-2023-42425

CVE-2023-42425 affects Turing Video Turing Edge+ EVC5FD v.1.38.6. The issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components. CVSS v3.1 base score 9.8 (CRITICAL) with NETWORK attack vector, LOW complexity, no privileges requir...

CVE-2023-45671

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

CVE-2023-45672

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-45670

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

Cross site scripting

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

Deserialization of untrusted data

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-45672

Frigate (open source NVR) contains an unsafe deserialization vulnerability in the configuration save path. The issue arises from loading user input via http.py into load_config_with_no_duplicates using yaml.loader.Loader, which can instantiate custom constructors and execute a payload at frigate/...

CVE-2023-45671

Frigate is an open‑source network video recorder. Prior to version 0.13.0 Beta 3, a reflected cross‑site scripting (XSS) vulnerability exists in API endpoints that rely on the / base path; values in the URL are not sanitized, enabling arbitrary JavaScript execution when an authenticated user is t...

CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-45670

CVE-2023-45670 : Frigate before 0.13.0 Beta 3 exposes a CSRF vulnerability in the config/save and config/set endpoints, allowing an attacker to trigger arbitrary configuration updates on a Frigate server via a crafted link. Exploitation requires the attacker to know specific server details and pe...