CVE-2017-16567

CVE-2017-16567 1. Título del exploit: Logitech Media Server: Cross Site Scripting persistente XSS 2. Shodan Dork: Buscar Logitech Media Server 3. Fecha: 11/03/2017 4. Autor del exploit: Dewank Pant 5. Página web del proveedor: www.logitech.com 6. Versión: 7.9.0 7. Probado en: Windows 10, Linux PO...

CVE-2021-33959

CVE-2021-33959 Se puede ver que el servicio de Plex escucha en los cuatro puertos UDP 32410, 32412, 32413 y 32414. Mediante el análisis de la carga útil del ataque y utilizando el formato de mensaje de la solicitud de consulta de dispositivo como referencia, escribimos software para enviar paquet...

CVE-2017-16568

CVE-2017-16568 1. Título del exploit: Logitech Media Server : inyección y ejecución de código HTML. 2. Dork de Shodan: Buscar Logitech Media Server 3. Fecha: 11/03/2017 4. Autor del exploit: Dewank Pant 5. Página del proveedor: www.logitech.com 6. Versión: 7.9.0 7. Probado en: Windows 10, Linux...

Freeloader

Soporte Docker para plexmediaservercrack Parchea Plex Media Server que se ejecuta en Docker — tanto la imagen oficial plexinc/pms-docker como la imagen de la comunidad lscr.io/linuxserver/plex — usando el mismo mecanismo de LDPRELOAD sobre la ejecución de PMS que la instalación nativa con systemd...

PlEXcalaison

Escalación de Privilegios Local PlEXcalasion - CVE-2021-42835 Plex Media Server para Windows anterior a la versión 1.25.0.5282, vulnerable a Time Of Check Time Of Use TOCTOU que permite a usuarios con pocos privilegios obtener privilegios de SYSTEM. Descubierto por Tomer Peled, Netanel Cohen y Am...

[SECURITY] Fedora 45 Update: icecast-2.4.4-29.fc45

Icecast is a streaming media server which currently supports Ogg Vorbis and MP3 audio streams. It can be used to create an Internet radio station or a privately running jukebox and many things in between. It is very versatile in that new formats can be added relatively easily and supports open...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

CVE-2021-21402

CVE-2021-21402 Lectura arbitraria de archivos en Jellyfin Descripción de la vulnerabilidad Jellyfin es un sistema de software de medios libre que se utiliza para controlar y gestionar medios y streaming. Es una alternativa a Emby y Plex, que proporciona contenido multimedia desde un servidor...

CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96651

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

CVE-2026-96654

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

EUVD-2026-85370

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96656

Plex Media Server versions before 1.43.3.10861 are vulnerable to an arbitrary file write flaw. The issue arises because the TranscoderH264Options preference is appended verbatim to the x264 option string during every transcode. An admin user can exploit this to write arbitrary files that may be e...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655

Plex Media Server versions before 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) . An authenticated user can exploit the '/video/:/transcode/universal' path parameter to force the server to make requests to arbitrary internal or external addresses . The provided documents do ...