CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7656
https://notcve.org/view.php?id=CVE-2019-7656
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5. • https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7656-PrivEscal-Wowza https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7656.txt https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes https://www.wowza.com/pricing/installer • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-7654
https://notcve.org/view.php?id=CVE-2019-7654
Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5. Wowza Streaming Engine versiones 4.8.0 y anteriores, sufre de múltiples vulnerabilidades de tipo CSRF. Por ejemplo, un administrador, al seguir un enlace, puede ser engañado para hacer cambios no deseados, como agregar otro usuario administrador por medio del archivo enginemanager/server/user/edit.htm en el componente Server->Users. • https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-Wowza https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txt https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes https://www.wowza.com/pricing/installer • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16922
https://notcve.org/view.php?id=CVE-2017-16922
In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request. En com.wowza.wms.timedtext.http.HTTPProviderCaptionFile en Wowza Streaming Engine en versiones anteriores a la 4.7.1, es posible el salto de la estructura de directorio y la recuperación de un archivo mediante una petición HTTP remota y especialmente manipulada. • https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2017-16922.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-7047
https://notcve.org/view.php?id=CVE-2018-7047
An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well). Se ha descubierto un problema en MBeans Server en Wowza Streaming Engine, en versiones anteriores a la 4.7.1. El sistema de archivos podría leerse y escribirse mediante JMX empleando las credenciales JMX por defecto (también podría ser posible la ejecución remota de código). • https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7047.txt https://www.wowza.com/docs/wowza-streaming-engine-4-7-1-release-notes • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7049
https://notcve.org/view.php?id=CVE-2018-7049
An issue was discovered in Wowza Streaming Engine before 4.7.1. There is an XSS vulnerability in the HTTP providers (com.wowza.wms.http.HTTPProviderMediaList and com.wowza.wms.http.streammanager.HTTPStreamManager) causing script injection and/or reflection via a crafted HTTP request. Se ha descubierto un problema en Wowza Streaming Engine, en versiones anteriores a la 4.7.1. Hay una vulnerabilidad de Cross-Site Scripting (XSS) en los proveedores HTTP (com.wowza.wms.http.HTTPProviderMediaList y com.wowza.wms.http.streammanager.HTTPStreamManager) que provocan la inyección y/o reflexión de scripts mediante una petición HTTP manipulada. • https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2018-7049.txt https://www.wowza.com/docs/wowza-streaming-engine-4-7-1-release-notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •