299 matches found
Race condition
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker with a foothold in a endpoint via a low-privileged user account can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC...
CVE-2021-42835
Plex Media Server up to version 1.24.4.5081-e362dc1ee is affected by a TOCTOU race in the exposed RPC interface of the Product Update Service, enabling a local attacker with a low-privileged account to interact with the RPC and execute code from a chosen path (local or via SMB) with the update se...
CVE-2021-42835
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker with a foothold in a endpoint via a low-privileged user account can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC...
PLEX Plex Media Server 访问控制错误漏洞
PLEX Plex Media Server is a suite of media player and media server software from Plex PLEX Switzerland. An Access Control Error vulnerability exists in Plex Media Server, which originates from a failure of the RPC service in the Product Update Service component to validate a user's identity. The...
PT-2021-23689
Name of the Vulnerable Software and Affected Versions Plex Media Server versions through 1.24.4.5081-e362dc1ee Description An issue allows an attacker with a foothold in an endpoint via a low-privileged user account to access the exposed RPC service of the update service component. The RPC...
CVE-2021-42835: Time-of-check Time-of-use (TOCTOU) Race Condition
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker with a foothold in a endpoint via a low-privileged user account can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC...
Plex Media Server -- security vulnerability
Plex Security Team reports: We have recently been made aware of a security vulnerability in Plex Media Server versions prior to 1.25.0 that could allow a local Windows user to obtain administrator privileges without authorization. To be clear, this required the user to already have local, physica...
DDoS attacks in Q1 2021
News overview Q1 2021 saw the appearance of two new botnets. News broke in January of the FreakOut malware, which attacks Linux devices. Cybercriminals exploited several critical vulnerabilities in programs installed on victim devices, including the newly discovered CVE-2021-3007. Botnet operator...
Plex Media Server < 1.21.3.4014 SSDP (PMSSDP) Reflection/Amplification DDoS Attack
Plex Media Server installations in a specific and uncommon network position could potentially be used to reflect UDP traffic on certain device-discovery ports as part of a possible DDoS distributed denial-of-service attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be...
Cybercriminals Now Using Plex Media Servers to Amplify DDoS Attacks
A new distributed denial-of-service attack DDoS vector has ensnared Plex Media Server systems to amplify malicious traffic against targets to take them offline. "Plex's startup processes unintentionally expose a Plex UPnP-enabled service registration responder to the general Internet, where it ca...
Cybercriminals Now Using Plex Media Servers to Amplify DDoS Attacks
A new distributed denial-of-service attack DDoS vector has ensnared Plex Media Server systems to amplify malicious traffic against targets to take them offline. "Plex's startup processes unintentionally expose a Plex UPnP-enabled service registration responder to the general Internet, where it ca...
Plex Media Server Installed (Mac OS X)
Binary data macosxplexmediaserverinstalled.nbin...
Plex Media Server Installed (Linux)
Binary data plexmediaserverinstalledlinux.nbin...
Plex Unpickle Dict Windows Remote Code Execution Exploit
This Metasploit module exploits an authenticated Python unsafe pickle.load of a Dict file. An authenticated attacker can create a photo library and add arbitrary files to it. After setting the Windows only Plex variable LocalAppDataPath to the newly created photo library, a file named Dict will b...
Plex Unpickle Dict Windows Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Plex Unpickle Dict Windows RCE', 'Description' = %q This module exploits an authenticated Python unsafe pickle.load of a Dict file. An...
Plex Media Server Installed (Windows)
Binary data plexwininstalled.nbin...
Plex Media Server Improper Access Control Vulnerability
Plex Media Server is a set of media player and media server software from the Swiss company Plex. An improper access control vulnerability exists in versions of Plex Media Server prior to 2020-6-15. An attacker could exploit this vulnerability to execute cross-origin application requests via any...
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests...
