CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-47171
https://notcve.org/view.php?id=CVE-2023-47171
10 Jan 2024 — An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read. Existe una vulnerabilidad de divulgación de información en la funcionalidad de ruta de archivo fragmentado aVideoEncoder.json.php de WWBN AVideo 11.6 y la confirmación maestra de desarrollo 15fed957fb. Una solicitud HTTP especialmente manipulada puede provocar la lectura de archivos ar... • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1869 • CWE-73: External Control of File Name or Path •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 1CVE-2023-48728
https://notcve.org/view.php?id=CVE-2023-48728
10 Jan 2024 — A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability. Existe una vulnerabilidad de cross site scripting (xss) en la funcionalidad functiongetOpenGraph videoName de WWBN AVideo 11.6 y la confirmación maestra de desarrollo 3c6bb3ff. Una solicitud HTTP especial... • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1883 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-47861
https://notcve.org/view.php?id=CVE-2023-47861
10 Jan 2024 — A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability. Existe una vulnerabilidad de cross site scripting (xss) en la funcionalidad user name channelBody.php de WWBN AVideo 11.6 y la confirmación maestra de desarrollo 15fed957fb. Una solicitud HTTP especialmente ... • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1884 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-32073 – AVideo command injection vulnerability
https://notcve.org/view.php?id=CVE-2023-32073
12 May 2023 — WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3. • https://github.com/jmrcsnchz/CVE-2023-32073 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-30860 – https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm
https://notcve.org/view.php?id=CVE-2023-30860
08 May 2023 — WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this ... • https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2023-30854 – WWBN AVideo vulnerable to OS Command Injection
https://notcve.org/view.php?id=CVE-2023-30854
28 Apr 2023 — AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4. • https://github.com/jmrcsnchz/CVE-2023-30854 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25314
https://notcve.org/view.php?id=CVE-2023-25314
25 Apr 2023 — Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user. • https://github.com/WWBN/AVideo/commit/2b44dee815b208da85e1dcafa9839391c3de2655 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25313
https://notcve.org/view.php?id=CVE-2023-25313
25 Apr 2023 — OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. • https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34652
https://notcve.org/view.php?id=CVE-2022-34652
22 Aug 2022 — A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter. Se presenta una vulnerabilidad de inyección sql en la funcionalidad ObjectYPT de WWBN AVideo versiones 11.6 y dev master commit 3... • https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33149
https://notcve.org/view.php?id=CVE-2022-33149
22 Aug 2022 — A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter. Se presenta una vulnerabilidad de inyección sql en la funcionalidad ObjectYPT de WWBN AVideo versiones 11.6 y dev master commit 3f7c0364. Una ... • https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •