Read the docs

Kaltura

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Kaltura records in CISA KEV

No Kaltura vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Kaltura Server 5 records HIGH Mwembed 2 records LOW

Records

5 records in Kaltura Server · all components

TI-2017-10304 CVE-2017-14143 · GHSA-pmgh-jv2x-393j

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to…

Priority HIGH 81

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.77424 Published 2017-09-19 No fix listed CWE-798
TI-2017-10302 CVE-2017-14141 · GHSA-6xrx-j6mc-jmfc

The wiki_decode Developer System Helper function in the admin panel in Kaltura before…

Priority LOW 37

The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03097 Published 2017-09-19 No fix listed CWE-502
TI-2017-10303 CVE-2017-14142 · GHSA-3xx8-9wcm-jhmc

Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote…

Priority LOW 31

Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerId or (2) playerVersion parameter to server/admin_console/web/…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01782 Published 2017-09-19 No fix listed CWE-79
Open these records in search →