77 matches found
CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The...
CVE-2024-31450
Owncast exposes an admin API at /api/admin, with the emoji/delete endpoint vulnerable to path traversal. The request’s emoji filename is appended to the emoji directory path, allowing users with administrative privileges to delete arbitrary files outside the emoji directory. This is a path traver...
CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The...
CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The...
PT-2024-24084 · Owncast · Owncast
Name of the Vulnerable Software and Affected Versions: Owncast versions prior to 0.1.3 Description: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL "/api/admin". The...
Owncast 安全漏洞
Owncast is an open source, self-hosted, decentralized, single-user real-time video streaming and chat server. A security vulnerability exists in Owncast versions prior to 0.1.3, which stems from the Owncast application exposing the administrator API at /api/admin, which can be exploited by an...
Cross-Site Request Forgery (CSRF)
github.com/owncast/owncast is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to allowing cross-origin requests using function RequireAdminAuth in the auth.go file, This flows enabling attackers to access privileged information such as the admin password by exploiting the...
CVE-2024-29026
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...
CVE-2024-29026 Owncast cross origin request
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...
CVE-2024-29026 Owncast cross origin request
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...
CVE-2024-29026
Owncast (github.com/owncast/owncast) is affected by CVE-2024-29026 due to a lenient CORS policy in versions 0.1.2 and earlier, allowing cross-origin requests to read privileged information and potentially leak the admin password. The root cause is improper cross-origin access control, as describe...
CVE-2024-29026 Owncast cross origin request
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit...
Owncast 安全漏洞
Owncast is an open source, self-hosted, decentralized, single-user real-time video streaming and chat server. A security vulnerability exists in Owncast 0.1.2 and earlier versions, which stems from a loose CORS policy that allows an attacker to make cross-origin requests to read privileged...
PT-2024-22679 · Owncast · Owncast
Name of the Vulnerable Software and Affected Versions: Owncast versions 0.1.2 and prior Description: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. A lenient CORS policy allows attackers to make a cross origin request, reading privileged...
Remote Code Execution
OwnCast is vulnerable to Remote Code Execution. The vulnerability is due to improperly validating authHost parameter of the indieauth function. This issue can be exploited by an attacker via injecting malicious code to execute malicious commands on the server side...
OwnCast remote code execution vulnerability
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...
GHSA-392H-R46J-Q24P OwnCast remote code execution vulnerability
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...
CVE-2023-46480
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...
