Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection Vulnerability

Exploit for jsp platform in category web applications Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection Reserved CVE: CVE-2018-13415 Vulnerability Overview The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity...

CVE-2018-13416

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2018-13416

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

Xxe

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2018-13416

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2018-13416

The CVE-2018-13416 issue affects Universal Media Server (UMS) 7.1.0, where the SSDP/UPnP XML parsing engine is vulnerable to XML External Entity Processing (XXE). Unauthenticated, remote attackers can (per multiple sources) read arbitrary files on the host, trigger SMB NetNTLM captures (cracking ...

Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection

Issue: Out-of-Band XXE in Plex Media Server's SSDP Processing Reserved CVE: CVE-2018-13415 Vulnerability Overview The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use...

Plex Media Server 1.13.2.5154 SSDP Processing XML Injection

Issue: Out-of-Band XXE in Plex Media Server's SSDP Processing Reserved CVE: CVE-2018-13415 Vulnerability Overview The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use...

Universal Media Server XML External Entity Injection Vulnerability

Universal Media Server Universal Media Server is a DLNA compatible UPnP media server. An XML external entity injection vulnerability exists in the XML parsing engine of Universal Media Server's SSDP/UPNP functionality, which can be exploited by an attacker to obtain sensitive information or execu...

Plex Media Server -- Information Disclosure Vulnerability

Chris reports: The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use this vulnerability to: Access arbitrary files from the filesystem with the same permission as the...

Universal Media Server 7.1.0 XML Injection

Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

Seagate Personal Cloud < 4.3.18.0 RCE Vulnerability

Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled. SPDX-FileCopyrightText: 2018 Greenbone AG Some text...

Synology Media Server SQL Injection Vulnerability

Synology Media Server is a set of media server software from Synology. A SQL injection vulnerability exists in Synology Media Server versions prior to 1.7.6-2842 and 1.4-2654. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'ObjectID' parameter...

Android NVIDIA Media Server Information Disclosure Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, and NVIDIA Media Server is a multimedia server component used in it. An information disclosure vulnerability exists in NVIDIA Media Server in versions prior to the Android...

Input validation

In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read due to improper input validation vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254...

CVE-2018-6254

In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read due to improper input validation vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254...

CVE-2018-6254

In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read due to improper input validation vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254...

CVE-2018-6254

CVE-2018-6254 affects Android devices with NVIDIA Media Server prior to the 2018-05-05 patch level. The issue is an out-of-bounds read caused by improper input validation, enabling local information disclosure. The vulnerability is rated Moderate (CVSS v3 base score 3.3 / LOW) with Local access a...

CVE-2018-6254

In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read due to improper input validation vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254...

Sql injection

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter...