TI-2018-14335 CVE-2018-20228 · GHSA-7ffx-829q-x7w2
Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
Priority LOW 35
Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF.
Vulnerabilities
12 records
TI-2018-10547 CVE-2018-14691 · GHSA-g26c-jm5c-rj7h
An issue was discovered in Subsonic 6.1.1.
Priority LOW 28
An issue was discovered in Subsonic 6.1.1.
TI-2018-10546 CVE-2018-14690 · GHSA-mghv-g8fc-wj5r
An issue was discovered in Subsonic 6.1.1.
Priority LOW 28
An issue was discovered in Subsonic 6.1.1.
TI-2018-10545 CVE-2018-14689 · GHSA-v729-jfvj-h7v7
An issue was discovered in Subsonic 6.1.1.
Priority LOW 28
An issue was discovered in Subsonic 6.1.1.
TI-2018-10544 CVE-2018-14688 · GHSA-rfhr-9452-8362
An issue was discovered in Subsonic 6.1.1.
Priority LOW 28
An issue was discovered in Subsonic 6.1.1.
TI-2018-06728 CVE-2018-9282 · GHSA-7qc8-2qm6-x6x6
An XSS issue was discovered in Subsonic Media Server 6.1.1.
Priority LOW 28
An XSS issue was discovered in Subsonic Media Server 6.1.1.
TI-2018-11337 CVE-2018-15898 · GHSA-x3mp-wrfx-jwgf
The Subsonic Music Streamer application 4.4 for Android has Improper Certificate…
Priority LOW 28
The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
TI-2017-06828 CVE-2017-9414 · GHSA-gp6h-mprg-xcxq
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in…
Priority MEDIUM 54
Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scrip…
TI-2018-04382 CVE-2018-6014 · GHSA-hjgr-77g7-5w6v
Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy…
Priority LOW 31
Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request.
TI-2017-06827 CVE-2017-9413 · GHSA-pp3h-p5vc-xr8h
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in…
Priority MEDIUM 42
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add pa…
TI-2017-06829 CVE-2017-9415 · GHSA-vvwq-frq9-95qp
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers…
Priority LOW 38
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted reque…
TI-2017-06780 CVE-2017-9355 · GHSA-cccx-rcqv-gwfj
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1…
Priority MEDIUM 54
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.