Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Serviio Clear all filters
TI-2017-14286 CVE-2017-20220 · GHSA-92xm-h2vg-5w9x

Serviio PRO 1.8 Unauthenticated Password Change via REST API

Priority HIGH 77

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00411 Published 2026-03-15 No fix listed CWE-306
TI-2017-14285 CVE-2017-20219 · GHSA-h5rm-m9g3-8wfw

Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser

Priority MEDIUM 56

Serviio PRO 1.8 DLNA Media Streaming Server contains a DOM-based cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00248 Published 2026-03-15 No fix listed CWE-79
TI-2017-14284 CVE-2017-20218 · GHSA-mxj5-2p9r-3838

Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path

Priority HIGH 72

Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00146 Published 2026-03-15 No fix listed CWE-428
TI-2017-14283 CVE-2017-20217 · GHSA-7pm8-r7x9-q9j5

Serviio PRO 1.8 REST API Information Disclosure

Priority HIGH 77

Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00687 Published 2026-03-15 No fix listed CWE-306