4914 matches found
CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV
执行摘要 macOS 的 Music 和 TV 存在不安全的重命名操作，导致通过完全控制用户的 TCC.db 来获得 FDA。 我针对每个应用分别提交了漏洞报告，如果适用，可以合并。 根本问题在于这些应用拥有 FDA 权限，但未能对其文件操作进行清理。 利用描述 Music 和 TV 在这方面几乎相同，只是路径不同。此后我将以 Music 为例。TV 的利用代码非常直接，请自行查看。 Music 具有将文件复制到用户资料库的功能，该功能通过一个专用文件夹实现，用户可以在此文件夹中“拖放”文件。 用户只需在 /Music/Music/Media.localized/Automaticall...
QNAP Music Station < 5.4.0 - Authentication Bypass
An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...
Lyrion Music Server <= 9.2.0 - Cross-Site Scripting
Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...
Joomla! Component Music Manager - Local File Inclusion
A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...
CVE-2026-104811
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
CVE-2026-104673
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...
CVE-2026-104673 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...
CVE-2026-104673
The Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin (versions n/a through 5.14.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability could allow an attacker to execut...
EUVD-2026-92318
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through...
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.14.2...
CVE-2026-104811
The Mitel MiVoice Office 400 is vulnerable to remote code execution due to an improper file type validation flaw in the Music on Hold functionality. Located in the web portal on TCP port 443 (Configuration → Services), the application fails to properly restrict uploaded files to the intended WAV ...
EUVD-2026-92305
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
CVE-2026-104811 Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
DC30-Badge-Challenge-Writeup
DC30-Badge-Challenge-Writeup 目录 介绍 挑战第 1 部分：收集音符 挑战第 2 部分：呼叫 YИИEႱ 挑战第 2A 部分：Alice 挑战第 2B 部分：Bob 挑战第 2C 部分：Carol 挑战第 2D 部分：Dan 挑战第 2E 部分：Eve 挑战第 2F 部分：Trevor 挑战第 3 部分：最终线索 如果我错过了大会上的电话怎么办？ 后记 介绍 大家好！我是 Pete，也叫 Kybr，这是我为 DEF CON 30 徽章挑战赛写的解题报告。...
[SECURITY] Fedora 45 Update: rhythmbox-3.5.0-2.fc45
Rhythmbox is an integrated music management application based on the powerful GStreamer media framework. It has a number of features, including an easy to use music browser, searching and sorting, comprehensive audio format support through GStreamer, Internet Radio support, playlists and more...
[SECURITY] Fedora 45 Update: pragha-1.3.3-36.fc45
Pragha is is a lightweight GTK+ music manager that aims to be fast, bloat-fre e, and light on memory consumption. It is written completely in C and GTK+. Pragha is a fork of Consonance Music Manager, discontinued by the original author...
CVE-2026-93624
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
CVE-2026-93624 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...
