Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Kaltura Component: Kaltura Server Clear all filters
TI-2017-10304 CVE-2017-14143 · GHSA-pmgh-jv2x-393j

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to…

Priority HIGH 81

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.77424 Published 2017-09-19 No fix listed CWE-798
TI-2017-10303 CVE-2017-14142 · GHSA-3xx8-9wcm-jhmc

Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote…

Priority LOW 31

Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerId or (2) playerVersion parameter to server/admin_console/web/…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01782 Published 2017-09-19 No fix listed CWE-79
TI-2017-10302 CVE-2017-14141 · GHSA-6xrx-j6mc-jmfc

The wiki_decode Developer System Helper function in the admin panel in Kaltura before…

Priority LOW 37

The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03097 Published 2017-09-19 No fix listed CWE-502