CVE-2018-21031

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

Information disclosure

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

CVE-2018-21031

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

CVE-2018-21031

CVE-2018-21031 affects Tautulli versions up to 2.1.38. The flaw arises from mishandling the X-Plex-Token, which can be retrieved from Tautulli and used to bypass access controls on Plex Media Server. The description indicates the affected product is Tautulli (not Plex Media Server itself), and it...

PT-2019-10458

Name of the Vulnerable Software and Affected Versions Tautulli versions 2.1.38 and below Description The issue allows remote attackers to bypass intended access control because the X-Plex-Token is mishandled and can be retrieved from Tautulli. Recommendations For Tautulli versions 2.1.38 and belo...

CVE-2018-21031: Insufficiently Protected Credentials

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product...

Tautulli 2.1.26 Cross Site Scripting

Tautulli https://tautulli.com/ is a Python based monitoring and tracking tool for Plex Media Server. We discovered that an authenticated Plex Media Server user could change their Plex username to include JavaScript and Tautulli would fail to sanitize the username so that when the Plex Media Serve...

PYSEC-2019-255

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

PYSEC-2019-255

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

CVE-2019-8939

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

CVE-2019-8939

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

CVE-2019-8939

Tautulli 2.1.26 is affected by a reflected XSS in data/interfaces/default/history.html when a crafted Plex username is mishandled during History page construction. The vulnerability could allow JavaScript execution in the context of the Plex server administrator if a user’s username contains inje...

PT-2019-20125

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.26 Description The issue concerns a problem with handling a crafted Plex username, which leads to XSS when constructing the History page, specifically affecting the data/interfaces/default/history.html file. Recommendation...

CVE-2019-8939: Improper Neutralization of Input During Web Page Generation

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page...

PT-2019-19272

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.26 Description The issue arises from a crafted Plex username that is mishandled when constructing the History page, leading to XSS. This occurs in the data/interfaces/default/history.html file. Recommendations For Tautulli...

FreeBSD : Plex Media Server -- Information Disclosure Vulnerability (337960ec-b5dc-11e8-ac58-a4badb2f4699)

Chris reports : The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use this vulnerability to : - Access arbitrary files from the filesystem with the same permission as...

CVE-2018-13415

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

Xxe

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2018-13415

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2018-13415

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...