7 matches found
CSRF, Reflected XSS and Stored XSS in add instance function
Description The add instance function allows to creation of an instance from user input but does not have any sanitizing mechanism which results in a Reflected XSS bug. This feature can be made by any user in the system, including guest users. After creating the instance will be saved on the...
WS-2023-0034
CSRF, Reflected XSS and Stored XSS in add instance function in ampache/ampache...
Debian DLA-1988-1 : ampache security update
Several vulnerabilities were discovered in Ampache, a web-based audio file management system. CVE-2019-12385 A stored XSS exists in the localplay.php LocalPlay 'add instance' functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to...
CVE-2019-12386
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...
UBUNTU-CVE-2019-12386
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...
Cross site scripting
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...
PT-2019-12775
Name of the Vulnerable Software and Affected Versions Ampache versions prior to 3.9.2 Description A stored XSS issue exists in the localplay.php LocalPlay "add instance" functionality, allowing injected code to be reflected in the instances menu. This can be exploited to force an admin into...