Baza CVE

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive…

Wykrycie ujawnienia informacji w AVideo pozwala nieautoryzowanym atakującym na dostęp do kluczy strumieniowych.

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server…

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the…

Obejście uwierzytelnienia w AVideo pozwala na ominięcie dwuetapowej weryfikacji na nowych urządzeniach.

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to…

Błąd w sterownikach Snowflake umożliwia atakującemu przejęcie tokenów uwierzytelniających.

An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload.

An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below.

Nieprawidłowa walidacja danych wejściowych w module PayTR Virtual Pos iFrame API umożliwia manipulację danymi.

Luka w PayTR Virtual Pos iFrame API WHMCS Module umożliwia inżynierię wsteczną.

Wykorzystanie zwolnionej pamięci w sterownikach GPU Arm pozwala na nieautoryzowany dostęp do danych.

Warunek wyścigu w sterownikach GPU Arm umożliwia lokalnemu użytkownikowi wywołanie odmowy usługi lub ujawnienie danych.

A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

Luka Use After Free w sterownikach GPU Arm umożliwia lokalnemu użytkownikowi dostęp do zwolnionej pamięci.

Luka Use After Free w sterownikach GPU Arm umożliwia lokalnemu użytkownikowi dostęp do zwolnionej pamięci.

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Wykorzystanie zwolnionej pamięci w sterowniku GPU Arm umożliwia lokalnemu użytkownikowi dostęp do danych.

Wstrzyknięcie poleceń w firmware Netis NX10 umożliwia administratorom wykonanie dowolnych komend jako root.

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.