CVE-2023-47171

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-47171

CVE-2023-47171 affects WWBN AVideo 11.6 and the dev master (commit 15fed957fb). TALOS documents an information disclosure via the aVideoEncoder.json.php chunkFile path functionality, allowing an attacker to read arbitrary files by supplying a crafted chunkFile parameter in an HTTP request. The ad...

CVE-2023-49862

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLgifimage parameter...

CVE-2023-49864

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLimage parameter...

CVE-2023-49862

The CVE-2023-49862 issue affects WWBN AVideo (dev master, commit 15fed957fb) in the image upload helper objects/aVideoEncoderReceiveImage.json.php. The root cause is a server-side file read via image URL handling: the code allows arbitrary local file reads by constructing a local path from the po...

CVE-2023-49863

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the downloadURLwebpimage parameter...

CVE-2023-49738

The CVE-2023-49738 issue affects WWBN AVideo (image404Raw.php). Cisco Talos reports a information-disclosure vulnerability where the image parameter (or REQUEST_URI) is used to build a path to read local files, enabling arbitrary file read (e.g., reading videos/configuration.php, which could reve...

CVE-2023-48730

Affected product: WWBN AVideo (dev master commit 15fed957fb). Vulnerability: Stored cross-site scripting (XSS) in navbarMenuAndLogo.php user name rendering due to improper sanitization. The user name is echoed into the navbar and can execute JavaScript when the page is loaded. Exploitation requir...

CVE-2023-48730

A cross-site scripting xss vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerabilit...

CVE-2023-49738

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-49738

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read...

CVE-2023-47861

Talos reports a high-severity (CVSS v3.1 9.0) cross-site scripting (XSS) vulnerability in WWBN AVideo 11.6 and the dev master commit 15fed957fb, specifically in channelBody.php user name handling. An attacker can lure a user to visit a crafted page, triggering arbitrary JavaScript execution (stor...

CVE-2023-47861

A cross-site scripting xss vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2023-48728

WWBN AVideo 11.6 (and dev master commit 3c6bb3ff) is affected by a reflected cross-site scripting (XSS) vulnerability in the function getOpenGraph videoName parameter. The issue arises from missing sanitization of the videoName input displayed on the OpenGraph page, enabling arbitrary JavaScript ...

CVE-2023-48728

A cross-site scripting xss vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2023-49715

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP...

CVE-2023-47861

A cross-site scripting xss vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this...

CVE-2023-49589

WWBN AVideo CVE-2023-49589 affects the dev master commit 15fed957fb where recoverPass generation uses insufficient entropy in userRecoverPass.php. Talos documents an ability to forge a password reset via a specially crafted HTTP request, enabling arbitrary password recovery for an administrator a...

CVE-2023-49589

An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this...

CVE-2023-49589

An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this...