Claudio Bozzato of Cisco Talos

4 exploits Active since Aug 2022
CVE-2022-26842 WRITEUP CRITICAL WRITEUP
WWBN AVideo 11.6 and dev master - Reflected Cross-Site Scripting in Charts Tab Selection
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVSS 9.6
CVE-2022-29468 WRITEUP HIGH WRITEUP
WWBN AVideo 11.6 and dev master commit 3f7c0364 - Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVSS 8.8
CVE-2022-30605 WRITEUP HIGH WRITEUP
WWBN AVideo 11.6 and dev master commit 3f7c0364 - Session Fixation via Crafted HTTP Request
A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVSS 8.8
CVE-2022-32778 WRITEUP HIGH WRITEUP
WWBN AVideo 11.6 and dev master commit 3f7c0364 - Information Disclosure via Cookie HttpOnly Flag Missing
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the session cookie via crafted HTTP requests.This vulnerability is for the pass cookie, which contains the hashed password and can be leaked via JavaScript.
CVSS 7.5