WordPress Cookie Nonsense for YT Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Cookie Nonsense for YT Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51933 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0e3863ff0bc1 Credits SOPROBRO Required privilege...

GLSA-202409-30 : yt-dlp: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202409-30 yt-dlp: Multiple Vulnerabilities Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for details. Tenable has extracted the preceding description block directly from the Gento...

yt-dlp: Multiple Vulnerabilities

Background yt-dlp is a youtube-dl fork with additional features and fixes. Description Multiple vulnerabilities have been found in yt-dlp. Please review the referenced CVE identifiers for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

Fedora: Security Advisory (FEDORA-2024-0ba1c1a435)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-72fb215fcd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in yt-yson-bindings (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 870d6e991bf31676829c84080af299f206568bc11d6f9b42bf5fe2dca50cb79d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-12371 Malicious code in yt-yson-bindings (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 870d6e991bf31676829c84080af299f206568bc11d6f9b42bf5fe2dca50cb79d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

[SECURITY] Fedora 39 Update: yt-dlp-2024.07.09-1.fc39

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...

Fedora 39 : yt-dlp (2024-72fb215fcd)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-72fb215fcd advisory. Update to 2024.07.09 ---- Update to 2024.07.07 ---- Update to 2024.07.02 Tenable has extracted the preceding description block directly from the Fedora...

The vulnerability of the yt-dlp download utility lies in its lack of measures to neutralize special elements used in the operating system’s command line, allowing a violator to execute arbitrary code.

The vulnerability of the YouTube-DLP download utility exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Supply Chain Attack

yt-dlp is vulnerable to Supply Chain Attack. The vulnerability is due to the use of a compromised CDN cdn.bootcdn.net which is used to fetch a component of the crypto-js JavaScript library, allowing an attacker to potentially inject and execute malicious JavaScript code...

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

amusing-app (>=0.2.0 <=0.4.2), arbi-tr-frontend (>=0.1.0 <=0.1.1) +56 more potentially affected by unknown CVE via yt-dlp (>=2023.9.24 <=2024.7.25)

yt-dlp PYPI version =2023.9.24, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =2024.3.25, =1.1.1, =0.0.1.2, =1.0.1.1, =0.3.0, =3.1.1, =0.1.0, =0.1.0, =0.1.1 - khan-dl =1.2.9 - kick-dl =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3V33-3WMW-3785...

GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

[SECURITY] Fedora 40 Update: yt-dlp-2024.07.02-1.fc40

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...

Fedora 40 : yt-dlp (2024-0ba1c1a435)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0ba1c1a435 advisory. Update to 2024.07.02 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Path Traversal

yt-dlp is vulnerable to Path Traversal. The vulnerability is due to unrestricted file extensions of downloaded files resulting in arbitrary filenames and path traversal on Windows, which could allows an attacker to execute arbitrary code...

OPENSUSE-SU-2024:14094-1 python310-yt-dlp-2024.07.01-1.1 on GA media

These are all security issues fixed in the python310-yt-dlp-2024.07.01-1.1 package on the GA media of openSUSE Tumbleweed...

africanwhisper (>=0.2.8 <=0.9.0), agentx-tools (>=0.2.0 <=0.7.1) +118 more potentially affected by CVE-2024-38519 via yt-dlp (>=2021.9.2 <=2024.5.27)

yt-dlp PYPI version =2021.9.2, =0.2.8, =0.2.0, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =0.0.4, =0.9.0, =0.1.0, =1.4.0, =2024.3.25, =1.1.1, =0.1.0, =0.3.2 and more Source cves: CVE-2024-38519 Source advisory: OSV:GHSA-79W7-VH3H-8G4J...

yt-dlp File system modification and RCE through improper file-extension sanitization

Summary yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp also reads config from the working directory and on Windows executables will be executed from the yt-dlp...