Vulnerabilities

TI-2015-06840 CVE-2015-8310 · GHSA-4wcc-jv3p-prqw

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote…

LOW 26

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00847 Published 2017-03-27 Fixed in 0.36.0 CWE-79

TI-2015-06839 CVE-2015-8309 · GHSA-q624-9634-77gh

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote…

LOW 30

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.06665 Published 2017-03-27 Fixed in 0.36.0 CWE-22

Vulnerabilities

Filters

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote…

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote…