Vulnerabilidades

Se ha solucionado un problema lógico con una gestión de estados mejorada. Este problema se ha solucionado en Pro Video Formats 2.2.5. Un usuario puede ser capaz de elevar privilegios.

La vulnerabilidad de Cross-Site Scripting (XSS) almacenado en la página "Map setting" de VI Web Client anterior a la versión 7.9.6 permite a un atacante remoto autenticado inyectar una secuencia de comandos arbitraria.

La vulnerabilidad de Cross-Site Scripting (XSS) almacenado en la página "View setting" de VI Web Client anterior a la versión 7.9.6 permite a un atacante remoto autenticado inyectar una secuencia de comandos arbitraria.

reflejada la vulnerabilidad de Cross-Site Scripting (XSS) en VI Web Client anterior a la versión 7.9.6 permite a un atacante remoto autenticado inyectar una secuencia de comandos arbitraria.

Vulnerabilidad de redireccionamiento abierto en VI Web Client anterior a 7.9.6 permite que un atacante remoto no autenticado redirija a los usuarios a sitios web arbitrarios y realice ataques de phishing a través de una URL especialmente manipulada.

Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Autenticada Almacenada (admin+) en el plugin Yotuwp Video Gallery en las versiones anteriores e incluyendo a la v1.3.12.

Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada en el plugin Video Gallery de I Thirteen Web Solution que afecta a las versiones 1.0.10 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado.

theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteModuleFrontController::run().

Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada en el plugin video carousel slider with lightbox de I Thirteen Web Solution que afecta a las versiones 1.0.22 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212…

Buffer Overflow vulnerability in ExtractorInformation function in streamExtractor.cpp in oggvideotools 0.9.1 allows remaote attackers to run arbitrary code via opening of crafted ogg file.

A Segmentation Fault issue discovered StreamSerializer::extractStreams function in streamSerializer.cpp in oggvideotools 0.9.1 allows remote attackers to cause a denial of service (crash) via opening of crafted ogg file.

Buffer Overflow vulnerability in oggvideotools 0.9.1 allows remote attackers to run arbitrary code via opening of crafted ogg file.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.

A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system. This…

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command injection attack that could result in remote code execution on an…

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin <= 2.0.1 versions.

Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for linux may allow an authenticated user to potentially enable escalation of privilege via local access.

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.

Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access.

Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.

HEVC Video Extensions Remote Code Execution Vulnerability

El consumo incontrolado de recursos en los SDK de Zoom anteriores a 5.14.7 puede permitir que un usuario no autenticado habilite una denegación de servicio a través del acceso a la red.

A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.