Lucene search
+L

1219 matches found

Kitploit
Kitploit
added 2026/09/14 6:22 p.m.9 views

Freeloader

Soporte Docker para plexmediaservercrack Parchea Plex Media Server que se ejecuta en Docker — tanto la imagen oficial plexinc/pms-docker como la imagen de la comunidad lscr.io/linuxserver/plex — usando el mismo mecanismo de LDPRELOAD sobre la ejecución de PMS que la instalación nativa con systemd...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 7:48 a.m.9 views

CVE-2017-16568

CVE-2017-16568 1. 漏洞标题:Logitech Media Server:HTML 代码注入与执行。 2. Shodan Dork:搜索 Logitech Media Server 3. 日期:11/03/2017 4. 漏洞作者:Dewank Pant 5. 厂商主页:www.logitech.com 6. 版本:7.9.0 7. 测试平台:Windows 10、Linux POC: 1. 访问并进入 Radio URL 标签页,然后添加一个新 URL。 2. 将脚本作为该字段的值添加。 3. 载荷: 4. 脚本保存后,会生成一条图像消息,点击图像时执行...

5.4CVSS6.1AI score0.01985EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/14 1:22 a.m.9 views

CVE-2017-16567

CVE-2017-16567 1. Título del exploit: Logitech Media Server: Cross Site Scripting persistente XSS 2. Shodan Dork: Buscar Logitech Media Server 3. Fecha: 11/03/2017 4. Autor del exploit: Dewank Pant 5. Página web del proveedor: www.logitech.com 6. Versión: 7.9.0 7. Probado en: Windows 10, Linux PO...

5.4CVSS6.1AI score0.02239EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/14 1:15 a.m.6 views

CVE-2021-33959

CVE-2021-33959 Se puede ver que el servicio de Plex escucha en los cuatro puertos UDP 32410, 32412, 32413 y 32414. Mediante el análisis de la carga útil del ataque y utilizando el formato de mensaje de la solicitud de consulta de dispositivo como referencia, escribimos software para enviar paquet...

7.5CVSS7.4AI score0.15035EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/11 1:27 p.m.12 views

CVE-2026-35031

CVE-2026-35031:Jellyfin 字幕上传路径遍历至 RCE -darkred?style=flat-square -orange?style=flat-square 摘要 Jellyfin 媒体服务器中存在一个严重的路径遍历漏洞,允许具有“上传字幕”权限的经过身份验证的用户将文件上传到磁盘上的任意位置。通过利用字幕上传端点中未经验证的 Format 字段,攻击者可以写入敏感位置的文件、窃取敏感数据、提升权限,并最终通过 LDPRELOAD 注入以 root 身份执行任意代码。 CVSS 评分: 9.9(严重) 受影响版本: Jellyfin 10.11.7 修复版本:...

9.9CVSS6.3AI score0.00753EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/08 11:31 p.m.7 views

CVE-2021-21402

CVE-2021-21402 Jellyfin任意文件读取 漏洞简介 jellyfin是一个自由的软件媒体系统,用于控制和管理媒体和流媒体。它是emby和plex的替代品,它通过多个应用程序从专用服务器向终端用户设备提供媒体。Jellyfin属于Emby 3.5.2 .NET核心框架,以支持完全的跨平台支持。...

7.7CVSS6.6AI score0.79855EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/08 6:21 p.m.9 views

PlEXcalaison

本地权限提升 - CVE-2021-42835 Windows 版 Plex Media Server 1.25.0.5282 之前版本存在检查时间与使用时间漏洞(TOCTOU),允许低权限用户获取 SYSTEM 权限。 发现者 Tomer Peled、Netanel Cohen 以及 BugSec 安全研究员 Amir Shen。 详情 Windows 版 Plex 使用 PlexUpdateService.exe 来安装新更新。该服务在 SYSTEM 上下文中运行。安装更新时,服务首先验证文件完整性和数字签名,只有检查通过后才安装更新。...

7CVSS7.1AI score0.01176EPSS
SaveExploits1References1
NVD
NVD
added 2026/08/24 9:16 a.m.14 views

CVE-2026-78321

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

6CVSS0.00164EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/24 8:47 a.m.26 views

CVE-2026-78321

The HTTP media server on multiple DJI drone models (including Neo, Flip, Air 3, Avata 2, Mavic 3, Mini 2–5 Pro, and others) lacks sufficient limits on incoming connections and request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeat...

6CVSS5.4AI score0.00164EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 8:47 a.m.56 views

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

6CVSS0.00164EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 8:47 a.m.16 views

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

6CVSS5.5AI score0.00164EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 8:16 a.m.23 views

CVE-2026-78255

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

8.7CVSS0.00239EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 7:25 a.m.62 views

CVE-2026-78255 DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

8.7CVSS0.00239EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/24 7:25 a.m.18 views

CVE-2026-78255

The HTTP media server embedded in affected DJI drone models exposes stored photos and videos through the /v2 endpoint without authenticating the requesting client . Because filenames follow a predictable pattern , an attacker who joins the drone's internal network can enumerate valid filenames an...

8.7CVSS5.3AI score0.00239EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/24 12:00 a.m.19 views

PT-2026-79837

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

8.7CVSS5.3AI score0.00239EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/24 12:00 a.m.16 views

PT-2026-79839

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

6CVSS5.3AI score0.00164EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/07 10:16 p.m.26 views

CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

2.1CVSS0.00264EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/07/07 10:16 p.m.19 views

CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

2.1CVSS6.1AI score0.00264EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/07 9:11 p.m.37 views

CVE-2026-59153 Anki's local HTTP server does not sufficiently validate requests

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

2.1CVSS0.00264EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/04 2:33 p.m.23 views

EUVD-2026-34286

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/ route that resolves attacker-controlled entries from imagehashlookup and replays them through the same server-side image fetch logic used by authenticated image proxying...

9.9CVSS5.9AI score0.00262EPSS
SaveExploits0References2
Rows per page
Query Builder