Total
17 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-19453 | 1 Wowza | 1 Streaming Engine | 2023-02-10 | 3.5 LOW | 5.4 MEDIUM |
| Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to insert a malicious payload that will be triggered in the main page of server settings. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2018-19365 | 1 Wowza | 1 Streaming Engine | 2023-01-20 | 6.4 MEDIUM | 9.1 CRITICAL |
| The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via a remote, specifically crafted HTTP request. | |||||
| CVE-2019-7655 | 1 Wowza | 1 Streaming Engine | 2022-10-13 | 3.5 LOW | 5.4 MEDIUM |
| Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of the login form. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2019-7654 | 1 Wowza | 1 Streaming Engine | 2022-10-13 | 4.3 MEDIUM | 6.5 MEDIUM |
| Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2021-35492 | 1 Wowza | 1 Streaming Engine | 2022-07-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager/server/vhost/historical.jsdata vhost parameter. This is due to the insufficient management of available filesystem resources. An attacker could exploit this vulnerability through the Virtual Host Monitoring section by requesting random virtual-host historical data and exhausting available filesystem resources. A successful exploit could allow the attacker to cause database errors and cause the device to become unresponsive to web-based management. (Manual intervention is required to free filesystem resources and return the application to an operational state.) | |||||
| CVE-2019-7656 | 1 Wowza | 1 Streaming Engine | 2022-05-03 | 7.2 HIGH | 7.8 HIGH |
| A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2020-9004 | 1 Wowza | 1 Streaming Engine | 2022-05-03 | 9.0 HIGH | 8.8 HIGH |
| A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2019-19455 | 1 Wowza | 1 Streaming Engine | 2022-04-28 | 7.2 HIGH | 7.8 HIGH |
| Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in the Linux version of the server by writing arbitrary commands in any file and execute them as root. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2021-31539 | 1 Wowza | 1 Streaming Engine | 2021-12-08 | 2.1 LOW | 5.5 MEDIUM |
| Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords. | |||||
| CVE-2021-31540 | 1 Wowza | 1 Streaming Engine | 2021-12-03 | 3.6 LOW | 7.1 HIGH |
| Wowza Streaming Engine through 4.8.5 (in a default installation) has incorrect file permissions of configuration files in the conf/ directory. A regular local user is able to read and write to all the configuration files, e.g., modify the application server configuration. | |||||
| CVE-2021-35491 | 1 Wowza | 1 Streaming Engine | 2021-11-05 | 5.8 MEDIUM | 8.1 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14. | |||||
| CVE-2018-7047 | 1 Wowza | 1 Streaming Engine | 2020-10-01 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well). | |||||
| CVE-2018-7049 | 1 Wowza | 1 Streaming Engine | 2020-10-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Wowza Streaming Engine before 4.7.1. There is an XSS vulnerability in the HTTP providers (com.wowza.wms.http.HTTPProviderMediaList and com.wowza.wms.http.streammanager.HTTPStreamManager) causing script injection and/or reflection via a crafted HTTP request. | |||||
| CVE-2018-7048 | 1 Wowza | 1 Streaming Engine | 2020-09-30 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request. | |||||
| CVE-2019-19456 | 1 Wowza | 1 Streaming Engine | 2020-09-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0. | |||||
| CVE-2019-19454 | 1 Wowza | 1 Streaming Engine | 2020-09-30 | 5.0 MEDIUM | 7.5 HIGH |
| An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0. | |||||
| CVE-2017-16922 | 1 Wowza | 1 Streaming Engine | 2020-09-30 | 5.0 MEDIUM | 5.3 MEDIUM |
| In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file are possible via a remote, specifically crafted HTTP request. | |||||