Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect')

Impact On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is only possible when the stream option is...

AllTube Download 代码问题漏洞

AllTube Download is a Youtube-dl Web Gui by Pierre Rudloff, an individual developer. AllTube Download suffers from a code issue vulnerability that stems from the fact that cross-site request forgery attacks can only occur on the HTML frontend of youtube-dl when Alltube has the "stream" option...

Server-Side Request Forgery (SSRF)

Description youtube-downloader takes an URL from the url query parameter, passes it directly to curl and streams the response to the browser. This makes it vulnerable to an SSRF attack if someone passes an URL containing an internal hostname, as it will stream internal resources to the browser...

Sever-side Request Forgery (SSRF)

rudloff/alltube is vulnerable to server-side request forgery. An attacker is able to pass malicious parameters which are directly fed into the youtube-dl command, allowing the attacker to perform malicious redirect, internal port scanning and obtaining sensitive information about services on...

Server-Side Request Forgery (SSRF) in rudloff/alltube

Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Part of the fix requires applyi...

GHSA-R5HC-WM3G-HJW6 Server-Side Request Forgery (SSRF) in rudloff/alltube

Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Part of the fix requires applyi...

WordPress Video Player for YouTube plugin <= 1.4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Video Player for YouTube plugin versions = 1.4.2. Solution Update the WordPress Video Player for YouTube plugin to the latest available version at least 1.5.1...

WordPress Automatic YouTube Gallery plugin < 1.6.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Automatic YouTube Gallery plugin versions 1.6.5. Solution Update the WordPress Automatic YouTube Gallery plugin to the latest available version at least 1.6.5...

WordPress Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin <= 2.3.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin versions = 2.3.5. Solution Update the WordPress Gallery Blocks with Lightbox. Image Gallery, HTML5...

WordPress YouTube Responsive Gallery plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress YouTube Responsive Gallery plugin versions = 1.0.1. Solution No patched version available...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

WordPress YouTube Responsive Gallery plugin <= 1.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress YouTube Responsive Gallery plugin versions = 1.0.1. Solution No patched version available...

AllTube Download 代码问题漏洞

AllTube Download is a Youtube-dl Web Gui by Pierre Rudloff, an individual developer. A security vulnerability exists in AllTube Download that stems from the presence of server-side request forgery SSRF in rudloff alltube...

WordPress Automatic YouTube Gallery plugin < 1.6.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Automatic YouTube Gallery plugin versions 1.6.5. Solution Update the WordPress Automatic YouTube Gallery plugin to the latest available version at least 1.6.5...

WordPress VidSEO | WordPress Video SEO embedder with transcripts (Youtube & Vimeo) plugin <= 1.2.3.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress VidSEO | WordPress Video SEO embedder with transcripts Youtube & Vimeo plugin versions = 1.2.3.2. Solution Update the WordPress VidSEO | WordPress Video SEO embedder with transcripts Youtube & Vimeo...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

WordPress Video Player for YouTube plugin <= 1.4.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Video Player for YouTube plugin versions = 1.4.2. Solution Update the WordPress Video Player for YouTube plugin to the latest available version at least 1.5.1...

Server-Side Request Forgery (SSRF)

Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Part of the fix requires applyi...

Beware bogus OperaGX sponsorship offers

If you’re a YouTuber, watch out for bogus Opera missives winging their way to you. The Browser team has had to send out a warning in relation to scammy antics trading on their good name. At a time when people are stretched for cash, nothing could be better than a promo mail bearing good news...

Big Mother is watching: What parents REALLY think about tracking their kids

Every year on Data Privacy Day, we’re greeted with countless arguments about the absolute merits of data privacy protections good, invasions bad, but we rarely see a faithful, factual accounting for the biggest data privacy conundrum facing billions of people every single day: Should parents inva...