CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

Design/Logic Flaw

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

Subsonic cross-site scripting vulnerability (CNVD-2018-19874)

Subsonic is a media file hosting platform. The 'namex', 'streamUrlx', and 'homepageUrlx' in the Subsonic version 6.1.1 A cross-site scripting vulnerability exists in the 'namex', 'streamUrlx', and 'homepageUrlx' parameters, which can be exploited by a remote attacker by sending 'namex',...

CVE-2018-14688

An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the namex, streamUrlx, homepageUrlx parameters where x is an integer to internetRadioSettings.view that could be used to steal session information of a victim...