CVE-2017-9413

Multiple cross-site request forgery CSRF vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that 1 subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or 2 update Internet Radio Settings via the...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that 1 subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or 2 update Internet Radio Settings via the...

CVE-2017-9413

Multiple cross-site request forgery CSRF vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that 1 subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or 2 update Internet Radio Settings via the...

CVE-2017-9413

CVE-2017-9413 affects Subsonic 6.1.1 via CSRF in the Podcast feature. The vulnerability allows an attacker to hijack the authentication of users for actions such as subscribing to a podcast (podcastReceiverAdmin.view) or altering Internet Radio Settings (networkSettings.view with urlRedirectCusto...

PT-2017-18903

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.1 Description The issue affects the Podcast feature, allowing remote attackers to hijack user authentication for specific requests. This can be achieved through exploiting cross-site request forgery CSRF vulnerabilities,...

CVE-2017-9413: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that 1 subscribe to a podcast via the add parameter to podcastReceiverAdmin.view or 2 update Internet Radio Settings via the...

CVE-2017-9415

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-9415

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-9415

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-9415

CVE-2017-9415 : Subsonic 6.1.1 is affected by a CSRF vulnerability that allows an attacker who knows or guesses a target username to hijack a user’s session and change passwords via requests to the relevant endpoint (userSettings.view). The connected documents confirm the vulnerability type, affe...

PT-2017-18904

Name of the Vulnerable Software and Affected Versions Subsonic version 6.1.1 Description A cross-site request forgery CSRF issue allows remote attackers with knowledge of the target username to hijack user authentication for requests that change passwords via a crafted request to...

CVE-2017-9415: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view...

CVE-2017-9355

XML external entity XXE vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted XSPF playlist file...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted XSPF playlist file...

CVE-2017-9355

XML external entity XXE vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted XSPF playlist file...

CVE-2017-9355

XML external entity XXE vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted XSPF playlist file...

CVE-2017-9355

CVE-2017-9355 is an XML External Entity (XXE) vulnerability in Subsonic 6.1.1’s import playlist feature that can enable server‑side request forgery (SSRF) via a crafted XSPF playlist file. The affected product is Subsonic v6.1.1 (import playlist parser/XXE handling), with in‑the‑wild references a...

Subsonic Password Reset Vulnerability

Subsonic is a media streaming server that allows users to save music or collect videos on the server. A password reset vulnerability exists in Subsonic. Due to a design flaw in the change reset password feature, an attacker could exploit the vulnerability to reset a specified user's password...

Subsonic Cross-Site Scripting Vulnerability

Subsonic is a media streaming server that allows users to save music or collect videos on the server. Subsonic suffers from a cross-site scripting vulnerability. A remote attacker could use this vulnerability to persistently inject arbitrary web script or HTML via the name of an uploaded image...