AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

Summary Type: Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpoint plugin/Meet/uploadRecordedVideo.json.php authenticates the caller using a single shared Authorization: Bearer against $objM-secret. Once that check passes, the endpoint reads the...

3com-nmc-tch.txt

Date: Mon, 21 Dec 1998 11:23:57 -0800 From: Entropy Reply-To: Bugtraq List To: [email protected] Subject: Fwd: Re: 3com The software that 3com has developed for running the NMC network management card for the Total Control Hubs is a bit shady. After uploading the software as one must do YOU wi...