EUVD-2023-52743

Malicious code in bioql PyPI...

Design/Logic Flaw

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the /Videos//stream and /Videos//stream. endpoints which are present in the current Jellyfin version. Additional endpoints in the...

CVE-2023-49096 Argument Injection in FFmpeg codec parameters in Jellyfin

Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the /Videos//stream and /Videos//stream. endpoints which are present in the current Jellyfin version. Additional endpoints in the...

CVE-2023-49096

Jellyfin (CVE-2023-49096) is vulnerable to argument injection in FFmpeg via the Videos//stream and Videos//stream. endpoints (and related AudioController endpoints). An unauthenticated attacker can attempt to inject extra FFmpeg arguments by abusing query parameters such as videoCodec and audioCo...