CVE-2024-24262

CVE-2024-24262 affects media-server v1.0.0 with a Use-After-Free in sip_uac_stop_timer ( /uac/sip-uac-transaction.c ). Root cause: UAF in the timer handling path. Impact stated as high availability risk (network-exposed, no authentication, no user interaction). Exploitation details are not provid...

CVE-2024-24262

media-server v1.0.0 was discovered to contain a Use-After-Free UAF vulnerability via the sipuacstoptimer function at /uac/sip-uac-transaction.c...

Fedora: Security Advisory for python-pysqueezebox (FEDORA-2023-1f06098c71)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2023-a04cc349e1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: python-pysqueezebox-0.5.5-11.fc38

Python library to control a Logitech Media Server asynchronously...

[SECURITY] Fedora 39 Update: python-pysqueezebox-0.5.5-11.fc39

Python library to control a Logitech Media Server asynchronously...

CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...

CVE-2023-43662

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

Authentication flaw

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

CVE-2023-43662 Arbitrary file read vulnerability in Shoko Server

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

CVE-2023-43662

ShokoServer exposes the /api/Image/WithPath endpoint without authentication in affected versions, passing serverImagePath to System.IO.File.OpenRead without sanitization, enabling arbitrary file reads via a path-traversal/LFI pattern. This can leak sensitive server files, particularly when the Wi...

LiveNVR of Anhui Green Persimmon Information Technology Co.

LiveNVR is a streaming media server software solution. Anhui Green Persimmon Information Technology Co., Ltd LiveNVR has an information leakage vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2023-33193

Emby Server Authentication Bypass (CVE-2023-33193): A proxy-header spoofing flaw allows login without a password or viewing accounts if reverse-proxy headers are mishandled, affecting publicly accessible servers with weak admin login settings. Root cause: spoofed headers misclassify local/non-loc...

CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

VulnCheck KEV: CVE-2023-33193

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

Universal Media Server 13.2.1 Cross Site Scripting

Exploit Title: Universal Media Server 13.2.1 Cross Site Scripting Google Dork: NA Date: 01/04/2023 Exploit Author: Yehia Elghaly - Mrvar0x Vendor Homepage: https://www.universalmediaserver.com/ Software Link: https://www.universalmediaserver.com/download/ Version: 13.2.1 Tested on: Windows 7 / 10...

The vulnerability of the cross-platform media center Plex Media Server, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the cross-platform media server Plex Media Server lies in the recovery of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Intel® Media Server Studio for Windows* Vulnerability Advisory

Summary: A potential security vulnerability in the Intel® Media Server Studio may allow for the escalation of privilege. Intel is releasing Media Server Studio updates and providing the instructions below to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2018-3697...

Plex Media Server Remote Code Execution Vulnerability

Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it...

LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach

The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date. The embattled password management service last week revealed how unidentified actors leveraged...