CVE-2008-3929

gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file...

CVE-2008-3929

Ampache 3.4.1 is affected: the gather-messages.sh script allows local users to overwrite arbitrary files via a symlink attack on /tmp/filelist. This CVE-2008-3929 is confirmed by multiple feeds (NVD entry and Gentoo/OpenVAS/Nessus advisories). Impact is local, with complete confidentiality/integr...

GLSA-200710-13 : Ampache: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200710-13 Ampache: Multiple vulnerabilities LT discovered that the 'match' parameter in albums.php is not properly sanitized before being processed. The Ampache development team also reported an error when handling user sessions...

Ampache: Multiple vulnerabilities

Background Ampache is a PHP-based tool for managing, updating and playing audio files via a web interface. Description LT discovered that the "match" parameter in albums.php is not properly sanitized before being processed. The Ampache development team also reported an error when handling user...

CVE-2007-4437

SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter. NOTE: some details are obtained from third party information...

CVE-2007-4438

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2007-4438

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2007-4437

SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter. NOTE: some details are obtained from third party information...

Sql injection

SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter. NOTE: some details are obtained from third party information...

Session fixation

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2007-4438

CVE-2007-4438 affects Ampache before 3.3.3.5. The vulnerability is a session-fixation flaw that allows remote attackers to hijack web sessions via unspecified vectors. Affected software is Ampache (web-based audio management) and the issue is documented across several sources including Gentoo GLS...

CVE-2007-4438

Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2007-4437

Ampache is affected up to versions prior to 3.3.3.5, where the match parameter in albums.php is not properly sanitized, enabling SQL injection. This could allow a remote attacker to execute arbitrary SQL commands. The advisories consistently recommend upgrading to Ampache 3.3.3.5 or newer as the ...

[SA22842] Ampache Unauthorized Guest Access

TITLE: Ampache Unauthorized Guest Access SECUNIA ADVISORY ID: SA22842 VERIFY ADVISORY: http://secunia.com/advisories/22842/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Ampache 3.x http://secunia.com/product/5347/ DESCRIPTION: A vulnerability has been reporte...

CVE-2006-5668

Unspecified vulnerability in Ampache 3.3.2 and earlier, when registerglobals is enabled, allows remote attackers to bypass security restrictions and gain guest access...

CVE-2006-5668

Unspecified vulnerability in Ampache 3.3.2 and earlier, when registerglobals is enabled, allows remote attackers to bypass security restrictions and gain guest access...

CVE-2006-5668

The CVE-2006-5668 entry concerns Ampache 3.3.2 and earlier where enabling PHP register_globals allows remote attackers to bypass security restrictions and gain guest access. The vulnerability’s root cause is tied to register_globals being on; CVSSv2 base score is 7.5 (HIGH) with network attack ve...

security flaw

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...

XML-RPC for PHP Remote Code Injection Vulnerability

Description XML-RPC for PHP is affected by a remote code-injection vulnerability. An attacker may exploit this issue to execute arbitrary commands or code in the context of the webserver. This may facilitate various attacks, including unauthorized remote access. XML-RPC for PHP 1.1 and prior...