1923 matches found
CVE-2010-1872-BlazeDVD-SEH-Exploit
BlazeDVD 5.0 - '.PLF' Playlist SEH Buffer Overflow Exploit CVE-2010-1872 Proof-of-Concept PoC exploit targeting a buffer overflow vulnerability in BlazeDVD version 5.0 via a crafted .plf playlist file. The exploit uses SEH Structured Exception Handler overwrite to achieve code execution. Details...
CVE-2009-0182
VUPlayer 2.49 Local Buffer Overflow to Arbitrary Code Execution Program Version: VUPlayer 2.49 Vulnerability: local buffer overflow when importing .wax playlist file that will lead to arbitrary code execution Exploitation: Local Buffer Overflow CVE: CVE-2009-0182 VUPlayer2.49poc.py : without bypa...
EUVD-2026-109229
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...
WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR
The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handleplaylistendpoint function accepted a user-controlled playlist ID and returned track data without authentication. id: CVE-2026-8679 info: name: WordPress...
CVE-2026-107697
A flaw was found in FFmpeg's HTTP Live Streaming HLS demuxer. A remote attacker can exploit this issue by supplying a specially crafted master playlist that references disallowed protocols or local files. This bypasses security restrictions and causes the application to open restricted resources,...
CVE-2026-107695
A flaw was found in FFmpeg. An infinite loop vulnerability in the HTTP Live Streaming HLS demuxer allows remote attackers to cause a Denial of Service DoS. By tricking a user into processing a specially crafted, self-referencing playlist file, an attacker can force the application into an endless...
PT-2026-108111
Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.3 Description An infinite loop issue exists in the HLS demuxer. The parse playlist function incorrectly accepts Master Playlist tags within Media Playlists. A remote attacker can exploit this by providing a crafted...
CVE-2026-63269
A flaw was found in LibreOffice. When processing linked audio or video files on Linux systems, the application uses the GStreamer multimedia framework for playback. By convincing a victim to open a specially crafted document containing a malicious HTTP Live Streaming HLS playlist, an attacker can...
DEBIAN-CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
UBUNTU-CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
EUVD-2026-92420
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
PT-2026-104816
Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description On Linux, the software uses GStreamer to play audio and video files linked within a document. A linked media file formatted as an HLS HTTP Live Streaming playlist—a protocol for streaming...
CVE-2026-63269: Server-Side Request Forgery (SSRF)
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In...
Linux Distros Unpatched Vulnerability : CVE-2026-63269
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the ConfigWriter::cleanUpString process. An attacker can execute arbitrary shell commands by injecting specially crafted Liquidsoap string interpolation sequences into playlist URLs or station metadata field...
CVE-2026-97061
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...
CVE-2026-97061 Black Candy through 3.2.1 Information Disclosure via Playlist Search
Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameter...