clipbucket-v5 vulnerabilities
21 known vulnerabilities in clipbucket-v5 from MacWarrior. 21 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads conc
- 7.2 High severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_templ
- 7.5 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection
- 8.8 High severity
clipbucket-v5: Unrestricted Upload of File with Dangerous Type
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an OS Command
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to exec
- 8.8 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.ph
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate se
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an OS Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a param
- 7.1 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endp
- 8.8 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` paramet
- 7.5 High severity
clipbucket-v5: Time-of-check Time-of-use (TOCTOU) Race Condition
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /act
- 8.8 High severity
clipbucket-v5: Weak Password Recovery Mechanism for Forgotten Password
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because
- 9.0 Critical severity
clipbucket-v5: Improper Neutralization of Input During Web Page Generation
ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vul
- 7.2 High severity
clipbucket-v5: Improper Control of Generation of Code
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tag
- 7.2 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the
- 9.8 Critical severity
clipbucket-v5: Unrestricted Upload of File with Dangerous Type
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks,
- 7.5 High severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
- 9.1 Critical severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirect
- 9.8 Critical severity
clipbucket-v5: Deserialization of Untrusted Data
ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get par
- 8.8 High severity
clipbucket-v5: Deserialization of Untrusted Data
ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inp