Vulnerabilities

TI-2024-34405 CVE-2024-51484

Insufficient Validation in Controllers (Activation/Deactivation) in Ampache

LOW 24

Ampache is a web based audio/video streaming application and file manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00357 Published 2024-11-11 Fixed in 7.0.1 CWE-352

TI-2024-34406 CVE-2024-51485

Insufficient Validation in Plugins (Activation/Deactivation) in Ampache

LOW 24

Ampache is a web based audio/video streaming application and file manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00357 Published 2024-11-11 Fixed in 7.0.1 CWE-352

TI-2024-34407 CVE-2024-51486

Stored Cross-Site Scripting in Ampache

LOW 37

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00528 Published 2024-11-11 Fixed in 7.0.1 CWE-79

TI-2024-34408 CVE-2024-51487

Insufficient Validation in Catalog (Activation/Deactivation) in Ampache

LOW 24

Ampache is a web based audio/video streaming application and file manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00357 Published 2024-11-11 Fixed in 7.0.1 CWE-352

TI-2024-34409 CVE-2024-51488

Insufficient Validation in Delete Message in Ampache

LOW 24

Ampache is a web based audio/video streaming application and file manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00294 Published 2024-11-11 Fixed in 7.0.1 CWE-352

TI-2024-34410 CVE-2024-51489

Insufficient Message Token Validation in Ampache

LOW 24

Ampache is a web based audio/video streaming application and file manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00296 Published 2024-11-11 Fixed in 7.0.1 CWE-352

TI-2024-34411 CVE-2024-51490

Stored Cross-Site Scripting in Ampache

MEDIUM 40

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00544 Published 2024-11-11 Fixed in 7.0.1 CWE-79

TI-2024-32095 CVE-2024-47828

Cross-Site Request Forgery in ampache

MEDIUM 62

ampache is a web based audio/video streaming application and file manager.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00314 Published 2024-10-09 No fix listed CWE-352

TI-2024-31551 CVE-2024-47184

Ampache vulnerable to Stored XSS via Democratic Playlist Name

MEDIUM 60

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0055 Published 2024-09-27 Fixed in 6.6.0 CWE-79

TI-2024-27727 CVE-2024-41665

Ampache Stored Cross-site Scripting Vulnerability

MEDIUM 58

Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.0046 Published 2024-07-23 Fixed in 6.6.0 CWE-79

TI-2024-19054 CVE-2024-28852

Ampache has multiple reflective XSS vulnerabilities

MEDIUM 60

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00516 Published 2024-03-27 Fixed in 6.3.1 CWE-79

TI-2024-19055 CVE-2024-28853

Ampache Stored XSS

MEDIUM 60

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00551 Published 2024-03-27 Fixed in 6.3.1 CWE-79

TI-2023-00731 CVE-2023-0771 · GHSA-qcj5-62mc-73xh

SQL Injection in ampache/ampache

HIGH 73

SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00746 Published 2023-02-10 Fixed in 5.5.7,develop CWE-89

TI-2023-00573 CVE-2023-0606 · GHSA-8hv3-rpq7-87v3

Cross-site Scripting (XSS) - Reflected in ampache/ampache

MEDIUM 62

Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00639 Published 2023-02-01 Fixed in 5.5.7 CWE-79

TI-2022-04263 CVE-2022-4665 · GHSA-w47p-6xf6-x3pf

Unrestricted Upload of File with Dangerous Type in ampache/ampache

HIGH 71

Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00809 Published 2022-12-23 Fixed in 5.5.6 CWE-434

TI-2021-12312 CVE-2021-32644

Cross-site Scripting in Random.php

LOW 30

Ampache is an open source web based audio/video streaming application and file manager.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00843 Published 2021-06-22 Fixed in 4.4.3 CWE-79

TI-2020-11925 CVE-2020-15153

Unauthenticated SQL injection in Ampache

MEDIUM 47

Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02398 Published 2021-04-30 Fixed in 4.2.2 CWE-89

TI-2021-04497 CVE-2021-21399

Unauthenticated SubSonic backend access in Ampache

MEDIUM 42

Ampache is a web based audio/video streaming application and file manager.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01438 Published 2021-04-13 Fixed in 4.4.1 CWE-284

TI-2019-09234 CVE-2019-12386 · GHSA-367h-866v-prvm

An issue was discovered in Ampache through 3.9.1.

LOW 26

An issue was discovered in Ampache through 3.9.1.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00839 Published 2019-08-22 No fix listed CWE-79

TI-2019-09233 CVE-2019-12385 · GHSA-p72w-3684-2crg

An issue was discovered in Ampache through 3.9.1.

MEDIUM 41

An issue was discovered in Ampache through 3.9.1.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01634 Published 2019-08-22 No fix listed CWE-89

TI-2017-13548 CVE-2017-18375 · GHSA-p3j4-f85x-cw86

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.

MEDIUM 41

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01613 Published 2019-05-24 No fix listed CWE-502

TI-2008-03768 CVE-2008-3929 · GHSA-qjvr-7m59-jj7m

gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a…

LOW 32

gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file.

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.00392 Published 2008-09-04 No fix listed CWE-59

TI-2007-04298 CVE-2007-4438 · GHSA-cmjp-5pjj-7527

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to…

LOW 33

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01474 Published 2007-08-20 No fix listed CWE-287

TI-2007-04297 CVE-2007-4437 · GHSA-h4hx-g865-m72c

SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote…

LOW 33

SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01277 Published 2007-08-20 No fix listed

TI-2006-05472 CVE-2006-5668 · GHSA-xwc8-wmf6-jq93

Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled…

LOW 36

Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.016 Published 2006-11-03 No fix listed

Vulnerabilities

Filters