494 matches found
WWBN AVideo session id privilege escalation vulnerability
Talos Vulnerability Report TALOS-2022-1535 WWBN AVideo session id privilege escalation vulnerability August 16, 2022 CVE Number CVE-2022-30605 SUMMARY A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafte...
WWBN AVideo aVideoEncoder wget OS command injection vulnerability
Talos Vulnerability Report TALOS-2022-1548 WWBN AVideo aVideoEncoder wget OS command injection vulnerability August 16, 2022 CVE Number CVE-2022-32572 SUMMARY An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A...
Open redirect in wwbn/avideo
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. A patch is available on the master branch of the repository...
GHSA-34HV-F45P-4QFQ Open redirect in wwbn/avideo
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. A patch is available on the master branch of the repository...
CVE-2022-27463
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page...
CVE-2022-27462
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...
CVE-2022-27463
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page...
CVE-2022-27462
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...
Cross site scripting
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...
CVE-2022-27463
WWBN AVideo (through v11.6) contains an open redirect in objects/login.json.php. The issue allows an attacker to redirect a user from a crafted URL to the login page. Public connected advisories confirm the vulnerability and, in the GitHub advisory, mention a patch available on the master branch....
CVE-2022-27463
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page...
CVE-2022-27462
Cross Site Scripting XSS vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php...
CVE-2022-27462
WWBN AVideo (through 11.6) is affected by CVE-2022-27462, a Cross Site Scripting (XSS) in objects/function.php:getDeviceID that can be triggered via the yptDevice parameter sent to view/include/head.php. The root cause is improper handling of the yptDevice input, allowing injected scripts to run ...