CVE-2002-0546

CVE-2002-0546: In the Winamp mini-browser (versions 2.78 and 2.79), the HTML/JS execution vulnerability is triggered by crafted ID3v1/ID3v2 tags in MP3 files, allowing remote script execution. The root cause is cross-site scripting within the mini-browser component when processing MP3 metadata. E...

CVE-2003-1272

CVE-2003-1272 affects Winamp 3.0. The vulnerability is described as multiple buffer overflows in Winamp’s b4s file handling, specifically when a long playlist name or a long path is passed to the Playstring parameter. This can allow a remote attacker to crash the application and potentially execu...

CVE-2003-1274

Winamp 3.0 is affected by a denial-of-service vulnerability triggered when processing a specially crafted .b4s playlist file. The Playstring parameter can be supplied with a file: argument containing MS-DOS device names (e.g., aux), causing the player to crash. Public references in NVD/CVE record...

CVE-2006-3228

CVE-2006-3228 affects Winamp’s MIDI parsing in the in_midi.dll plugin. A buffer overflow can be triggered by a crafted MIDI file, enabling remote code execution according to NVD and Nessus-derived descriptions. Affected versions include Winamp 2.90 up to 5.23 (including 5.21). Exploitation is ach...

CVE-2008-3567

CVE-2008-3567 affects Winamp before 5.541: cross-zone scripting via the NowPlaying feature allows XSS through an MP3 file with JavaScript in id3 tags. Vulnerable component is Winamp’s NowPlaying metadata handling; root cause is unsanitized id3 tag content rendered by the embedded browser. Observe...

CVE-2010-4372

Winamp (before 5.6) is affected via the in_nsv plugin, with CVE-2010-4372 describing an integer/heap-based overflow in NSV metadata handling that can be triggered by crafted NSV TOC data. Multiple sources corroborate a similar class of vulnerability affecting in_nsv.dll and NSV streams/files, cap...

CVE-2002-2412

CVE-2002-2412 affects Winamp 2.80, where authentication credentials are stored in plaintext in the winamp.ini file (in the HTTP-AUTH and winamp sections). This plaintext storage enables local users to access other accounts on the same system. Documented sources from multiple feeds (NVD/Red Hat/CV...

CVE-2010-4374

The CVE-2010-4374 entry concerns Winamp’s in_mkv plugin (pre-5.6). A crafted Matroska Video (MKV) file containing a string with a crafted length can cause the application to crash (DoS). Technical details across connected records confirm the affected component and the nature of the vulnerability ...

CVE-2011-4857

CVE-2011-4857 describes a heap-based buffer overflow in Winamp’s in_mod.dll plugin (pre-5.623) triggered by crafted Impulse Tracker (IT) file data, enabling remote code execution. The issue is tied to parsing/handling in IT data and relates to the in_mod.dll component used by Winamp 5.x. Public d...

CVE-2010-4370

CVE-2010-4370 affects Winamp through the in_midi plugin, where an integer wrapping/overflow in MIDI parsing can trigger a heap/buffer overflow, enabling remote code execution via a crafted MIDI file. Exploitation context: remote attacker; affected version range: Winamp before 5.6. Mitigation: upg...

CVE-2002-1524

Winamp 3 (version 1.0.0.488) is affected by a buffer overflow in the XML parser function wsabi.dll. An attacker can craft a skin file (.wal) containing a long include file tag to potentially execute arbitrary code on a remote system. The vulnerability is described as a buffer overflow in the XML ...