PT-2022-23265 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server version 4.6.7.0 Description: The issue affects the playlist name field, which is vulnerable to stored XSS. This vulnerability allows for the potential theft of the administrator access token, enabling attackers to either flip or...

CVE-2022-36223

In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account...

CVE-2022-36223

In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account...

CVE-2022-36223

Emby Server 4.6.7.0 is affected by a stored XSS in the playlist name field that can be exploited to steal the administrator access token and take over the media server administrator account. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OSV, etc.). Public exploit details ar...

Emby Server Arbitrary File Read Vulnerability

Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. An arbitrary file read vulnerability exists in Emby Server that originates from Emby Server on Windows not properly restricting access to...

Emby Server < 4.5.0 SSRF Vulnerability

Emby Server is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Emby Server <= 4.7.6.0 Information Disclosure Vulnerability

Emby Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-32833

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are...

CVE-2021-32833

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are...

Design/Logic Flaw

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are...

CVE-2021-32833

CVE-2021-32833 affects Emby Server on Windows, with arbitrary file read vulnerabilities disclosed in version 4.6.4.0 and possibly not patched in later versions. Publicly referenced vulnerable routes include: /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name, and /Im...

CVE-2021-32833 Unauthenticated file read in Emby Server

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are...

Emby Server 安全漏洞

Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. An arbitrary file read vulnerability exists in Emby Server that originates from Emby Server on Windows not properly restricting access to...

Emby Server Cross-Site Request Forgery Vulnerability

Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. Emby Server suffers from a cross-site request forgery vulnerability that allows an attacker to use SSRF via the ImageURL parameter of...

CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

Server side request forgery (ssrf)

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

CVE-2020-26948

The CVE-2020-26948 issue affects Emby Server prior to version 4.5.0. The Nuclei template confirms a server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter. The vulnerability enables the server to make requests to internal resources, with the CVSS 3.1 vector CVSS:3....

CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

PT-2020-16565 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.5.0 Description: The issue allows for Server-Side Request Forgery SSRF via the ImageURL parameter in the Items/RemoteSearch/Image endpoint. This means an attacker could potentially force the server to make...