CPE Details
VideoWhisper Live Streaming Integration 4.0.7 for WordPress
4.0.7
2019-07-22
11h23 +00:00
11h23 +00:00
2019-07-22
11h23 +00:00
11h23 +00:00
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
CPE Name: cpe:2.3:a:videowhisper:videowhisper_live_streaming_integration:4.0.7:*:*:*:*:wordpress:*:*
Informations
Vendor
videowhisperProduct
videowhisper_live_streaming_integrationVersion
4.0.7Target Software
wordpressRelated CVE
| CVE ID | Publié | Description | Score | Gravité |
|---|---|---|---|---|
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15. | 9.8 |
Critique |
||
| Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename. | 10 |
|||
| The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. | 5 |
|||
| Cross-site scripting (XSS) vulnerability in ls/vv_login.php in the VideoWhisper Live Streaming Integration plugin 4.27.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the room_name parameter. | 4.3 |
