CVE-2018-7203

Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...

CVE-2018-7171

The CVE-2018-7171 entry relates to Twonky Server (versions 7.0.11–8.5). The vulnerability is a directory traversal in the contentbase parameter of rpc/set_all, enabling remote attackers to access arbitrary directories. Multiple OpenVAS entries corroborate Twonky Server as affected and link the is...

CVE-2018-7203

CVE-2018-7203 affects Twonky Server 7.0.11–8.5, with a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all. The vulnerability is described in the NVD entry for CVE-2018-7203 and is corroborated by OpenVA...

CVE-2018-7171: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...

CVE-2018-7203: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...