CVE-2017-14142: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 partnerId or 2 playerVersion parameter to server/adminconsole/web/tools/bigRedButton.php; the 3 partnerId, 4 playerVersion, 5 secret, 6 entryId, 7...

Authorization

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...