Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• planetestream planet estreambefore 6.72.10.07

Other highest-scoring records for the same primary product.

• CVE-2022-45896Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document.
  39Monitor
• CVE-2022-45891Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access
  36Monitor
• CVE-2022-45893Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing
  35Monitor
• CVE-2022-45889Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the databa
  28Monitor
• CVE-2022-45894GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
  26Monitor
• CVE-2022-45890In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.