Input validation

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3...

CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3...

AzuraCast 安全漏洞

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. An Access Control Error vulnerability exists in versions of AzuraCast prior to 0.18.3 that stems from an improper restriction of excessive authentication attempts. An attacker could exploit the vulnerability to brute force...

CVE-2023-2531: Improper Restriction of Excessive Authentication Attempts

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3...

CVE-2023-2531 Improper Restriction of Excessive Authentication Attempts in azuracast/azuracast

Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3...

CVE-2023-2531

The CVE-2023-2531 entry concerns AzuraCast (azuracast/azuracast) before version 0.18.3, where the login rate-limiting/anti-brute-force control could be bypassed, enabling credential brute-forcing. Multiple connected sources corroborate that older AzuraCast releases lacked effective restriction on...

Cross-Site Scripting (XSS)

azuracast/azuracast, is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of sanitization in the getDisplayName, parameter of main.phtml which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Stored Cross-site Scripting (XSS)

azuracast/azuracast is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists in main.phtml because the user display name in the menu is not properly escaped before being rendered, allowing an attacker to inject and execute malicious JavaScript through the display name...

AzuraCast Cross-Site Scripting Vulnerability

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. A cross-site scripting vulnerability exists in AzuraCast version 0.18 and earlier, which stems from the lack of effective filtering and escaping of user-supplied data in the name field on the Edit Profile page, and can be...

Broken Rate Limiting

Description The request rate limiting feature on the login page can be bypassed. If we look at the code in src/Controller/Frontend/Account/LoginAction.php php $this-rateLimit-checkRequestRateLimit$request, 'login', 30, 5; We see that checkRequestRateLimit is invoked with a restriction of a maxmim...

Reflected XSS in Path Traversal detector

Description Azuracast has a feature that block all Path Traversal tentative good job implementing it. But when azuracast block an attack reflect the path without sanitize the output PathTraversalDetected.php. It is possibile to do attack like Reflected XSS or HTML injection. Step to reproduce 1. ...

GHSA-Q55C-HMPF-6H2G AzuraCast/AzuraCast vulnerable to cross-site scripting

AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is...

AzuraCast/AzuraCast vulnerable to cross-site scripting

AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is...

CVE-2023-2191

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

AzuraCast 跨站脚本漏洞

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. A cross-site scripting vulnerability exists in AzuraCast version 0.18 and earlier, which stems from the lack of effective filtering and escaping of user-supplied data in the name field on the Edit Profile page, and can be...

CVE-2023-2191: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191

CVE-2023-2191 describes a stored XSS in AzuraCast prior to version 0.18 (specifically in the display name on the Edit Profile page). The underlying issue is insufficient filtering/escaping of user-provided data in that field, allowing a crafted payload to execute in the victim’s browser. Public d...