CVE-2022-45896

Planet eStream (Planet Enterprises) prior to version 6.72.10.07 is vulnerable to an unauthenticated file upload issue via Upload2.ashx or Ajax.asmx/ProcessUpload2 (e.g., Choose a Video / Related Media or Upload Document), which can lead to remote code execution. The affected product/version is Pl...

CVE-2022-45896

Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution...

CVE-2022-45889

Planet eStream before 6.72.10.07 allows a remote attacker who is a publisher or admin to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search the StatisticsResults.aspx flt parameter...

CVE-2022-45893

Planet eStream (versions prior to 6.72.10.07) has a cookie-based authentication flaw in the ON cookie that can be exploited by a low-privilege user to access administrative and high-privilege accounts. A brute-force attack can compute a value enabling permanent access, effectively compromising co...

PT-2022-27669 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: A Reflected Cross-Site Scripting XSS issue exists via any metadata filter field, for example, when searching within Default.aspx using the r or fo parameter. This allows for malicious...

CVE-2022-45894

Planet eStream (Planet Enterprises) before version 6.72.10.07 is affected by CVE-2022-45894 due to a directory traversal vulnerability in GetFile.aspx that allows reading arbitrary local files. The root cause is improper path handling enabling traversal via ..\ sequences. Impact is read access to...

PT-2022-27667 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows a remote attacker, who is a publisher or admin, to obtain access to all records stored in the database and execute arbitrary SQL commands via Search, specifically throu...

PT-2022-27675 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue allows unauthenticated upload of arbitrary files, which can lead to remote code execution. This can be achieved through "Choose a Video / Related Media or Upload Document" or ...

CVE-2022-45891

Planet eStream prior to version 6.72.10.07 contains critical vulnerabilities that allow an attacker to call restricted functions, perform unauthenticated uploads via Upload2.ashx, and access content uploaded by other users (View.aspx after Ajax.asmx/SaveGrantAccessList). The CVE entry cites unaut...

CVE-2022-45895

Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie findable in HTML source code for Default.aspx in some situations and the WhoAmI endpoint e.g., path disclosure...

Planet eStream Code Execution / SQL Injection / XSS / Broken Control Vulnerabilities

Planet eStream versions prior to 6.72.10.07 suffer from shell upload, account takeover, broken access control, SQL injection, both persistent and reflective cross site scripting, path traversal, and information disclosure vulnerabilities...

Planet Enterprises Planet eStream 跨站脚本漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A cross-site scripting vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which...

Planet Enterprises Planet eStream 代码问题漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A code issue vulnerability exists in versions prior to Planet Enterprises Planet eStream 6.72.10.07, which can be...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in versions prior to Planet Enterprises Planet eStream 6.72.10.07, which can be...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07. The...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It makes video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which was...

Planet Enterprises Planet eStream 路径遍历漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A path traversal vulnerability exists in versions prior to Planet Enterprises Planet eStream 6.72.10.07, which can b...

Planet eStream Code Execution / SQL Injection / XSS / Broken Control

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: Planet Enterprises Ltd - Planet eStream vulnerable version: 6.72.10.07 fixed version: 6.72.10.07 CVE number: CVE-2022-45896,...

Planet Enterprises Planet eStream SQL注入漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A SQL injection vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which...

Planet Enterprises Planet eStream 跨站脚本漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A cross-site scripting vulnerability exists in versions prior to Planet Enterprises Planet eStream 6.72.10.07, which...