Centova Technologies Inc Centova Cast vulnerabilities

CVE-2019-25351 [HIGH] CWE-862 CVE-2019-25351: Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to re Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using curl and wget requests.

CVE-2019-25342 [HIGH] CWE-770 CVE-2019-25342: Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm th Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoint. Attackers can trigger 100% CPU load by sending multiple concurrent requests to the /api.php endpoint with crafted parameters.