CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

CVE-2018-20228

CVE-2018-20228 concerns Subsonic V6.1.5 where an issue in internetRadioSettings.view streamUrl enables CSRF, enabling Server-Side Request Forgery (SSRF). Public description confirms the vulnerability affecting Subsonic 6.1.5 and identifies CSRF and SSRF as the outcomes. NVD data lists CVSS scores...

CVE-2018-14688

CVE-2018-14688 affects Subsonic 6.1.1. Three stored XSS vulnerabilities exist in the radio settings inputs name[x], streamUrl[x], and homepageUrl[x] that are sent to internetRadioSettings.view, enabling an attacker to steal session information. Publicly documented details in CNVD-2018-19874 and C...

CVE-2018-14688

An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the namex, streamUrlx, homepageUrlx parameters where x is an integer to internetRadioSettings.view that could be used to steal session information of a victim...