Stored Cross-site Scripting (XSS)

azuracast/azuracast is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists in main.phtml because the user display name in the menu is not properly escaped before being rendered, allowing an attacker to inject and execute malicious JavaScript through the display name...

AzuraCast Cross-Site Scripting Vulnerability

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. A cross-site scripting vulnerability exists in AzuraCast version 0.18 and earlier, which stems from the lack of effective filtering and escaping of user-supplied data in the name field on the Edit Profile page, and can be...

Broken Rate Limiting

Description The request rate limiting feature on the login page can be bypassed. If we look at the code in src/Controller/Frontend/Account/LoginAction.php php $this-rateLimit-checkRequestRateLimit$request, 'login', 30, 5; We see that checkRequestRateLimit is invoked with a restriction of a maxmim...

Reflected XSS in Path Traversal detector

Description Azuracast has a feature that block all Path Traversal tentative good job implementing it. But when azuracast block an attack reflect the path without sanitize the output PathTraversalDetected.php. It is possibile to do attack like Reflected XSS or HTML injection. Step to reproduce 1. ...

GHSA-Q55C-HMPF-6H2G AzuraCast/AzuraCast vulnerable to cross-site scripting

AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is...

AzuraCast/AzuraCast vulnerable to cross-site scripting

AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is...

CVE-2023-2191

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

AzuraCast 跨站脚本漏洞

AzuraCast is a simple self-hosted webcast management suite from AzuraCast. A cross-site scripting vulnerability exists in AzuraCast version 0.18 and earlier, which stems from the lack of effective filtering and escaping of user-supplied data in the name field on the Edit Profile page, and can be...

CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

PT-2023-18353

Name of the Vulnerable Software and Affected Versions Azuracast versions prior to 0.18.0 Description The issue is related to stored Cross-site Scripting XSS in the AzuraCast GitHub repository. A user with an existing AzuraCast account could update their display name to inject malicious JavaScript...

CVE-2023-2191

CVE-2023-2191 describes a stored XSS in AzuraCast prior to version 0.18 (specifically in the display name on the Edit Profile page). The underlying issue is insufficient filtering/escaping of user-provided data in that field, allowing a crafted payload to execute in the victim’s browser. Public d...

CVE-2023-2191 Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

CVE-2023-2191

Cross-site Scripting XSS - Stored in GitHub repository azuracast/azuracast prior to 0.18...

Stored XSS

Description The Name field in Edit Profile page is vulnerable to Stored XSS. 1. Navigate to https://demo.azuracast.com/ and login 2. Navigate to my account page 3. Click edit profile 4. Change the user name to the below payload 5. Every page of the application will now display an alert pop up on...

Cross-Site Request Forgery (CSRF) in azuracast/azuracast

✍️ Description Attacker able to enable any Streamer/DJ account section with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your...