CVSS: 4.3EPSS: 81%CPEs: 1EXPL: 3CVE-2007-1229 – Nullsoft SHOUTcast 1.9.7 - Logfile HTML Injection
https://notcve.org/view.php?id=CVE-2007-1229
Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp), which is not properly handled in the administrator interface when viewing the log file. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Nullsoft ShoutcastServer 1.9.7 permite a atacantes remotos inyectar scripts web o HTML de su elección mediante la URI top-level en el interfaz Incoming (puerto tcp/8001), que no es gestionado apropiadamente en la interfaz de administrador cuando se visualiza el fichero de trazas. • https://www.exploit-db.com/exploits/29685 http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0604.html http://osvdb.org/33793 http://secunia.com/advisories/24323 http://www.securityfocus.com/archive/1/461474/100/0/threaded http://www.securityfocus.com/bid/22742 http://www.vupen.com/english/advisories/2007/0775 https://exchange.xforce.ibmcloud.com/vulnerabilities/32726 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 2%CPEs: 19EXPL: 3CVE-2006-3534
https://notcve.org/view.php?id=CVE-2006-3534
Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing "/content". Vulnerabilidad de salto de directorio en Nullsoft SHOUTcast DSP versiones anteriores a la 1.9.6, filtra secuencias de salto de directorio antes de decodificarse, lo que permite a atacantes remotos leer ficheros de su elección a través de secuencias codificadas punto punto (%2E%2E) en una petición HTTP GET para una ruta de archivo que contenga "/content". • http://bugs.gentoo.org/show_bug.cgi?id=136721 http://people.ksp.sk/~goober/advisory/001-shoutcast.html http://secunia.com/advisories/20524 http://security.gentoo.org/glsa/glsa-200607-05.xml http://securitytracker.com/id?1016493 http://www.shoutcast.com/#news http://www.vupen.com/english/advisories/2006/2801 •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2006-3007
https://notcve.org/view.php?id=CVE-2006-3007
Multiple cross-site scripting (XSS) vulnerabilities in SHOUTcast 1.9.5 allow remote attackers to inject arbitrary HTML or web script via the DJ fields (1) Description, (2) URL, (3) Genre, (4) AIM, and (5) ICQ. Múltiples vulnerabilidades de XSS en SHOUTcast 1.9.5 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los campos DJ (1) Description, (2) URL, (3) Genre, (4) AIM y (5) ICQ. • http://marc.info/?l=bugtraq&m=114980135615062&w=2 http://secunia.com/advisories/20524 http://secunia.com/advisories/21005 http://www.gentoo.org/security/en/glsa/glsa-200607-05.xml http://www.securityfocus.com/bid/18376 http://www.vupen.com/english/advisories/2006/2254 https://exchange.xforce.ibmcloud.com/vulnerabilities/27129 •
CVSS: 7.5EPSS: 97%CPEs: 3EXPL: 3CVE-2004-1373 – SHOUTcast DNAS/Linux 1.9.4 - Format String Remote Overflow
https://notcve.org/view.php?id=CVE-2004-1373
Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a content URL, as demonstrated in the filename portion of a .mp3 file. • https://www.exploit-db.com/exploits/712 https://www.exploit-db.com/exploits/830 https://www.exploit-db.com/exploits/16751 http://marc.info/?l=bugtraq&m=110382975516003&w=2 http://marc.info/?l=bugtraq&m=110886444014745&w=2 http://securitytracker.com/id?1012675 http://www.gentoo.org/security/en/glsa/glsa-200501-04.xml http://www.securityfocus.com/bid/12096 https://exchange.xforce.ibmcloud.com/vulnerabilities/18669 •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 5CVE-2003-1174 – Nullsoft SHOUTcast 1.9.2 - 'icy-name/icy-url' Memory Corruption
https://notcve.org/view.php?id=CVE-2003-1174
Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long URL. • https://www.exploit-db.com/exploits/23328 https://www.exploit-db.com/exploits/23329 http://secunia.com/advisories/10146 http://securitytracker.com/id?1008080 http://www.osvdb.org/2776 http://www.securityfocus.com/archive/1/343177 http://www.securityfocus.com/bid/8954 https://exchange.xforce.ibmcloud.com/vulnerabilities/13586 •