GHSA-V8MC-9377-RWJJ yt-dlp File Downloader cookie leak

Impact During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in all versions of...

yt-dlp File Downloader cookie leak

Impact During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in all versions of...

CVE-2023-35934 yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934

CVE-2023-35934 affects yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. The issue: during file downloads, yt-dlp or its external downloaders may leak cookies by sending them as a Cookie header, including in the info JSON, causing cookies to be sent to domains/paths not scoped. All native...

CVE-2023-35934 yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934 yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

yt-dlp 信息泄露漏洞

yt-dlp is based on the youtube-dl branch of the now-inactive youtube-dlc. An information disclosure vulnerability previously existed in yt-dlp version 2023.07.06, which stemmed from an external downloader used by the app that could leak cookies when HTTP redirected to other hosts...

YourChannel < 1.2.4 - Unauthenticated Settings Reset

The plugin does not have authorisation check when reset its settings, allowing unauthenticated attackers to reset them and remove YT channels from the plugin...

Malicious Package

Overview yt-test-reporter is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in yandex-yt-driver-rpc-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d0f9ac59839194083f459004f9fb0fbfac06a2f78f9cdfea46685072490801d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yandex-yt-proto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c9f270b18c048619a98a11ad6711b3ede1d6d8ea3486df6a9825486efcae60c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-993 Malicious code in yandex-yt-proto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c9f270b18c048619a98a11ad6711b3ede1d6d8ea3486df6a9825486efcae60c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-992 Malicious code in yandex-yt-driver-rpc-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d0f9ac59839194083f459004f9fb0fbfac06a2f78f9cdfea46685072490801d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-995 Malicious code in yandex-yt-yson-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef8f5064d17e16f308f05ff124d515f803d1acfdc65fa58b4c26a8ac52041b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-994 Malicious code in yandex-yt-transfer-manager-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5e8ad10f31088a063adf3ff93799c1850d56418c603e0af2e811977873b7ae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview yandex-yt-proto is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview yandex-yt-transfer-manager-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable...