CVE Vulnerability Catalog

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/Live/uploadPoster.php endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary live_schedule_id. The endpoint only checks User::isLogged() but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a socketLiveOFFCallback notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption. Commit 1e6dc20172de986f60641eb4fdb4090f079ffdce contains a patch.

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability, allowing remote attackers to cause a denial of service by sending excessive renegotiation requests.

The Wazuh Manager authd service in wazuh-manager packages through 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation, allowing remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and make the authd service unavailable.

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks. Any unauthenticated user can download images belonging to any flow by knowing or guessing the flow ID and file name.

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL using the endpoint '/user.php/'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user's behalf.

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.

A SQL injection vulnerability was detected in mingSoft MCMS up to version 5.5.0, affecting the list function in ContentAction.java within the Web Content List Endpoint component. Input manipulation leads to SQL injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.

WWBN AVideo versions up to and including 26.0: isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

In AVideo versions up to and including 26.0, the AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled id parameter without validating ownership of the referenced video. An authenticated user with AI permissions can reference any AI response ID.

WWBN AVideo up to and including 26.0 has a get_api_video_password_is_correct endpoint allowing any unauthenticated user to verify whether a password is correct for any password-protected video. The endpoint returns a boolean passwordIsCorrect field with no rate limiting, CAPTCHA, or authentication, enabling efficient brute-force attacks. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

WWBN AVideo versions up to and including 26.0 contain three list.json.php endpoints in the Scheduler plugin that lack any authentication check, while other endpoints in the same directories require User::isAdmin(). An unauthenticated attacker can retrieve all scheduled tasks, admin-composed email messages, and user-to-email targeting mappings via simple GET requests.

In AVideo versions up to and including 26.0, the objects/playlistsVideos.json.php endpoint returns the full video contents of any playlist by ID without authentication or authorization checks. Private playlists (including watch_later and favorite types) are hidden from listing endpoints but their contents are directly accessible via the sequential integer playlists_id parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca contains a patch.

OpenBao versions prior to 2.5.2 with OIDC/JWT authentication enabled and a role configured with `callback_mode=direct` are vulnerable to XSS via the `error_description` parameter on the failed authentication page. An attacker can steal the token used in the Web UI by a victim.

In brace-expansion prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, hanging the process for seconds and allocating large amounts of memory.

GlobaLeaks prior to version 5.0.89 performs only minimal validation on user-submitted support requests sent to the /api/support endpoint. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.

Prior to version 9.6.0, calibre has a path traversal vulnerability in handling images in Markdown and similar text-based files, allowing inclusion of arbitrary files from the file system into the converted book. Missing authentication and SSRF in the background-image endpoint of the ebook reader web view allow exfiltration without additional interaction.

calibre contains a Server-Side Request Forgery vulnerability in the background-image endpoint of its web view. An attacker can perform blind GET requests to arbitrary URLs and exfiltrate information out of the ebook sandbox. Version 9.6.0 patches the issue.

In Blog.Core up to version bcb4d17, the getinfobytoken API interface has improper access control leading to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.