Wwbn Avideo vulnerabilities

CVE-2022-33148 [HIGH] CWE-89 CVE-2022-33148: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev mast A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulatin

CVE-2022-32778 [HIGH] CWE-732 CVE-2022-32778: An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and d An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. Thi

CVE-2022-32282 [HIGH] CWE-836 CVE-2022-32282: An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master comm An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges.

CVE-2022-33147 [HIGH] CWE-89 CVE-2022-33147: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev mast A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowin

CVE-2022-34652 [HIGH] CWE-89 CVE-2022-34652: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev mast A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulatin

CVE-2022-30534 [HIGH] CWE-78 CVE-2022-30534: An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AV An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-32572 [HIGH] CWE-78 CVE-2022-32572: An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-33149 [HIGH] CWE-89 CVE-2022-33149: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev mast A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the

CVE-2022-29468 [HIGH] CWE-352 CVE-2022-29468: A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3 A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

CVE-2022-30605 [HIGH] CWE-384 CVE-2022-30605: A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

CVE-2022-32772 [MEDIUM] CWE-79 CVE-2022-32772: A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the

CVE-2022-32771 [MEDIUM] CWE-79 CVE-2022-32771: A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the

CVE-2022-28710 [MEDIUM] CWE-73 CVE-2022-28710: An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 an An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-32761 [MEDIUM] CWE-73 CVE-2022-32761: An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWB An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2022-32768 [MEDIUM] CWE-862 CVE-2022-32768: Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWB Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability ex

CVE-2022-30690 [MEDIUM] CWE-79 CVE-2022-30690: A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

CVE-2022-32769 [MEDIUM] CWE-862 CVE-2022-32769: Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWB Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability ex

CVE-2022-32770 [MEDIUM] CWE-79 CVE-2022-32770: A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the

CVE-2022-27462 [MEDIUM] CWE-79 CVE-2022-27462: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVi Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.

CVE-2022-27463 [MEDIUM] CWE-601 CVE-2022-27463: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.