CVE-2022-29468

A cross-site request forgery CSRF vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability...

CVE-2022-29468

CVE-2022-29468 affects WWBN AVideo 11.6 and the dev master commit 3f7c0364. Talos confirms a CSRF vulnerability with no protection across the app, enabling privilege escalation when an authenticated user is tricked into submitting a crafted request (e.g., password change). Affected versions inclu...

CVE-2022-28712

A cross-site scripting xss vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger thi...

CVE-2022-28712

A cross-site scripting xss vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger thi...

CVE-2022-28712

A cross-site scripting xss vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger thi...

CVE-2022-28712

CVE-2022-28712 (WWBN AVideo) is a stored XSS in videoAddNew for WWBN AVideo 11.6 and dev master commit 3f7c0364. An authenticated user can post to objects/videoAddNew.json.php with a crafted videoLink or manipulated title, causing unsanitized titles to be rendered on lists/pages via getVideosList...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-28710

The CVE-2022-28710 affects WWBN AVideo 11.6 and dev master commit 3f7c0364. TALOS-2022-1550 documents an information disclosure vulnerability in the chunkFile functionality that allows an attacker to read arbitrary files via a specially crafted HTTP request, e.g., using chunkFile to trick the upl...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-26842

WWBN AVideo is affected by a reflected XSS (CVE-2022-26842) in the charts tab selection feature. The vulnerability stems from unsanitized use of the jump GET parameter in view/charts.php, enabling arbitrary Javascript execution when an authenticated user clicks or loads a crafted link. Affected v...

CVE-2022-26842

A reflected cross-site scripting xss vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP...

PT-2022-21447 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: An information disclosure issue exists in the aVideoEncoderReceiveImage functionality. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger th...

PT-2022-21454 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 and dev master commit 3f7c0364 Description: A cross-site scripting issue exists in the footer alerts functionality. This is caused by a specially-crafted HTTP request that can lead to arbitrary Javascript execution. ...

PT-2022-21710 · Unknown +1 · Wwbn Avideo +1

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A SQL injection issue exists in the ObjectYPT functionality, specifically within the Live Schedules plugin. This allows an attacker to inject SQL by manipulating the title parameter in a specially-crafte...

PT-2022-20234 · Wwbn · Wwbn Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A cross-site scripting issue exists in the image403 functionality. This allows an attacker to execute arbitrary Javascript code through a specially-crafted HTTP request. An attacker can exploit this by...

PT-2022-20163 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: An OS command injection issue exists in the aVideoEncoder chunkfile functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigge...

PT-2022-18094 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 and dev master commit 3f7c0364 Description: A reflected cross-site scripting issue exists in the charts tab selection functionality. This can be triggered by a specially-crafted HTTP request, leading to arbitrary...

PT-2022-20200 · Wwbn · Wwbn Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A privilege escalation issue exists in the session id functionality. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP...

PT-2022-21452 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 and dev master commit 3f7c0364 Description: A cross-site scripting xss vulnerability exists in the footer alerts functionality. This issue allows for arbitrary Javascript execution through a specially-crafted HTTP...