CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-28710

The CVE-2022-28710 affects WWBN AVideo 11.6 and dev master commit 3f7c0364. TALOS-2022-1550 documents an information disclosure vulnerability in the chunkFile functionality that allows an attacker to read arbitrary files via a specially crafted HTTP request, e.g., using chunkFile to trick the upl...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-26842

A reflected cross-site scripting xss vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP...

CVE-2022-26842

A reflected cross-site scripting xss vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP...

CVE-2022-26842

A reflected cross-site scripting xss vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP...

CVE-2022-32761: External Control of File Name or Path

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-30534: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-30605: Session Fixation

A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability...

CVE-2022-32769: Missing Authorization

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP reque...

SUSE: Security Advisory (SUSE-SU-2022:2855-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-33148: Improper Neutralization of Special Elements used in an SQL Command

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

CVE-2022-28710: External Control of File Name or Path

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CISA Adds 7 New Actively Exploited Vulnerabilities to Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday moved to add a critical SAP security flaw to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The issue in question is CVE-2022-22536, which has received the highest possible risk scor...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

Summary: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Description: The following chunked request is processed. It should be rejected as Transfer-Encoding header obfuscatio...

SUSE SLES15 / openSUSE 15 Security Update : nodejs10 (SUSE-SU-2022:2855-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2855-1 advisory. - CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation bsc1188917,...

SUSE-SU-2022:2855-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation bsc1188917, bsc1189368. - CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2021-22960, CVE-2021-22959: Fixed multiple HTTP request smuggli...

CVE-2022-30946

A cross-site request forgery CSRF vulnerability in Jenkins Script Security Plugin 1158.v7c1b73a69a08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +443 more potentially affected by CVE-2022-35948 via undici (>=5.0.0, <=5.8.1)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =2.0.0, =1.6.0, =1.0.0, =0.2.0-beta.0, =1.0.0, =0.3.0, =0.3.21 and more Source cves: CVE-2022-35948 Source advisory: OSV:GHSA-F772-66G8-Q5H3...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +443 more potentially affected by CVE-2022-35949 via undici (>=5.0.0, <=5.8.1)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =2.0.0, =1.6.0, =1.0.0, =0.2.0-beta.0, =1.0.0, =0.3.0, =0.3.21 and more Source cves: CVE-2022-35949 Source advisory: OSV:GHSA-8QR4-XGW6-WMR3...