162 matches found
EUVD-2018-6584
Malware in sbrugna...
EUVD-2018-12794
Malware in sbrugna...
EUVD-2018-6582
Malware in sbrugna...
EUVD-2017-18349
Malware in sbrugna...
EUVD-2018-7754
Malware in sbrugna...
EUVD-2017-18350
Malware in sbrugna...
EUVD-2018-17777
Malware in sbrugna...
EUVD-2017-18348
Malware in sbrugna...
EUVD-2021-8696
Malicious code in bioql PyPI...
EUVD-2023-3317
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2021-21399
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic AP...
VulnCheck KEV: CVE-2025-27112
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
CVE-2023-51442
Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed wit...
CVE-2021-21399
Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and...
FreeBSD : Navidrome -- Authentication bypass in Subsonic API (5ca2cafa-1f24-11f0-ab07-f8f21e52f724)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5ca2cafa-1f24-11f0-ab07-f8f21e52f724 advisory. Deluan reports: In certain Subsonic API endpoints, authentication can be bypassed by using a non-existe...
SUSE CVE-2025-27112
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
GO-2025-3484 Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome...
CVE-2025-27112
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
GHSA-C3P4-VM8F-386P Navidrome allows an authentication bypass in Subsonic API with non-existent username
Summary In certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty salted password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error. Details A flaw...
Navidrome allows an authentication bypass in Subsonic API with non-existent username
Summary In certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty salted password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error. Details A flaw...