Planetestream vulnerabilities
We track 4 vulnerabilities in Planetestream products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 25, 2022.
Latest Planetestream vulnerabilities
- 9.8 Critical severity
Planet Estream: Unrestricted Upload of File with Dangerous Type
Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.
- 8.8 High severity
Planet Estream: Improper Restriction of Excessive Authentication Attempts
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access.
- 9.1 Critical severity
Planet Estream: Incorrect Authorization
Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access content uploaded by other users (View.aspx after Ajax.asmx/SaveGrantAccessList).
- 7.2 High severity
Planet Estream: Improper Neutralization of Special Elements used in an SQL Command
Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter).