66 matches found
CVE-2018-9177
The CVE-2018-9177 entry documents a cross-site scripting (XSS) vulnerability in Twonky Server prior to version 8.5.1 , exploitable via a folder name on the Shared Folders screen. The affected component is the web UI handling folder names, with the root cause being improper handling/encoding of us...
CVE-2018-9182
Twonky Server before 8.5.1 is affected by a cross‑site scripting (XSS) vulnerability exposed via a modified "language" parameter in the Language section. The issue stems from improper handling of the language parameter, enabling XSS payloads. Impact is consistent with XSS (partial integrity impac...
Twonky Server Cross-Site Scripting Vulnerability (CNVD-2018-14438)
LYNX Twonky Server is a media server from LYNX TECHNOLOGY, Inc. that supports the sharing of media content between connected devices. A cross-site scripting vulnerability exists in LYNX Twonky Server versions prior to 8.5.1. A remote attacker can exploit the vulnerability to execute code via fold...
Twonky Server Cross-Site Scripting Vulnerability (CNVD-2018-11374)
LYNX Twonky Server is a media server from LYNX TECHNOLOGY, Inc. that supports the sharing of media content between connected devices. A cross-site scripting vulnerability exists in LYNX Twonky Server versions prior to 8.5.1. The vulnerability can be exploited by a remote attacker to execute code...
Western Digital My Cloud EX2 NAS Device Leaks Files
UPDATE Western Digital’s My Cloud EX2 storage devices leak files to anyone on a local network by default, no matter the permissions set by users. If configured for remote access via the public internet, the My Cloud EX2 also leaks files via an HTTP request on port 9000, according to researchers a...
CVE-2018-1143
The connected CNVD entry confirms a vulnerability in Belkin N750 routers (firmware 1.10.22) that allows an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a crafted HTTP request to twonky_command.cgi. Impact is elevated: full root command execution, e...
Twonky Server 7.0.11 - 8.5 Multiple Vulnerabilities - Active Check
Twonky Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lynxtechnology:twonkyserver";...
Twonky Server 7.0.11 - 8.5 Multiple Vulnerabilities - Version Check
Twonky Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lynxtechnology:twonkyserver";...
Twonky Server Directory Traversal Vulnerability
Twonky Server is the industry-leading DLNA/UPnP media server from Lynx Technology that enables the sharing of media content between connected devices. A directory traversal vulnerability exists in Twonky Server. A remote attacker could use the contentbase parameter of rpc/setall in the ... double...
Twonky Server Cross-Site Scripting Vulnerability
Twonky Server is the industry-leading DLNA/UPnP media server from Lynx Technology that enables the sharing of media content between connected devices. A cross-site scripting vulnerability exists in Twonky Server. A remote attacker can exploit this vulnerability to inject arbitrary web script or...
CVE-2018-7171
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...
CVE-2018-7203
Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...
CVE-2018-7171
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...
CVE-2018-7203
Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...
Cross site scripting
Cross-site scripting XSS vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/setall...
Directory traversal
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...
CVE-2018-7171
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. dot dot in the contentbase parameter to rpc/setall...
CVE-2018-7171
The CVE-2018-7171 entry relates to Twonky Server (versions 7.0.11–8.5). The vulnerability is a directory traversal in the contentbase parameter of rpc/set_all, enabling remote attackers to access arbitrary directories. Multiple OpenVAS entries corroborate Twonky Server as affected and link the is...
CVE-2018-7203
CVE-2018-7203 affects Twonky Server 7.0.11–8.5, with a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all. The vulnerability is described in the NVD entry for CVE-2018-7203 and is corroborated by OpenVA...