CVE-2018-1000664

CVE-2018-1000664 affects daneren2005 DSub for Subsonic (Android client) v5.4.1. The vulnerability is CWE-295: Improper Certificate Validation in the HTTPS client, causing acceptance of any non-CA signed server certificate (including self-signed and expired). Exploitation requires the victim to co...

CVE-2018-1000664: Improper Certificate Validation

daneren2005 DSub for Subsonic Android client version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable...

PT-2018-9516

Name of the Vulnerable Software and Affected Versions DSub for Subsonic Android client version 5.4.1 Description The issue concerns improper certificate validation in the HTTPS client, allowing any non-CA signed server certificate, including self-signed and expired certificates, to be accepted by...

CVE-2017-9414

Cross-site request forgery CSRF vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting XSS attacks or possibly have unspecified other impact via the name paramet...

CVE-2017-9414

Cross-site request forgery CSRF vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting XSS attacks or possibly have unspecified other impact via the name paramet...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting XSS attacks or possibly have unspecified other impact via the name paramet...

CVE-2017-9414

CVE-2017-9414 affects Subsonic 6.1.1 (Subscribe to Podcast) where the Subscribe to Podcast feature is vulnerable to CSRF that can lead to stored persistent XSS via the name parameter in playerSettings.view. Exploitation details shown in multiple sources demonstrate a CSRF/XSS chain that could all...

CVE-2017-9414

Cross-site request forgery CSRF vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting XSS attacks or possibly have unspecified other impact via the name paramet...

CVE-2017-9414: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting XSS attacks or possibly have unspecified other impact via the name paramet...

PT-2018-8507

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.1 Description A cross-site request forgery CSRF issue exists in the Subscribe to Podcast feature, allowing remote attackers to hijack the authentication of victims for requests that conduct cross-site scripting XSS attacks...

Subsonic Cross-Site Request Forgery Vulnerability

Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. A cross-site request forgery vulnerability exists in Subsonic version 6.1.3. The vulnerability can be exploited to retrieve sensitive user information by tricking a user into visiting a website...

CVE-2018-6014

Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...

CVE-2018-6014

Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...

Cross site scripting

Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...

CVE-2018-6014

Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...

CVE-2018-6014

CVE-2018-6014 affects Subsonic v6.1.3, where an insecure Flash cross-domain policy (allow-access-from domain="*") can enable an attacker to retrieve sensitive user information via a read request. Exploitation requires convincing a user to visit a site containing a specially crafted SWF file to st...

CVE-2018-6014: Exposure of Sensitive Information to an Unauthorized Actor

Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...

PT-2018-17297

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.3 Description The issue allows an attacker to retrieve sensitive user information via a read request, exploiting an insecure allow-access-from domain="" Flash cross-domain policy. To exploit this, an attacker must convince...

Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability

Document Title: =============== Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2115 Video: https://www.youtube.com/watch?v=t3nYuhAHOMg http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6014...

Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability

Document Title: =============== Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2115 Video: https://www.youtube.com/watch?v=t3nYuhAHOMg http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6014...