CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-19141
https://notcve.org/view.php?id=CVE-2019-19141
19 Dec 2019 — The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH. La funcionalidad Camera Upload en P... • https://forums.plex.tv/t/security-camera-upload/507289 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-21031
https://notcve.org/view.php?id=CVE-2018-21031
18 Nov 2019 — Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product. Las versiones 2.1.38 y posteriores de Tautulli permiten a los atacantes remotos eludir el control de acceso previsto en Plex Me... • https://forums.plex.tv/t/security-regarding-cve-2018-21031/493286 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.8EPSS: 35%CPEs: 1EXPL: 3CVE-2018-13415 – Plex Media Server 1.13.2.5154 - SSDP Processing XML External Entity Injection
https://notcve.org/view.php?id=CVE-2018-13415
03 Aug 2018 — In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote ... • https://packetstorm.news/files/id/148810 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-8914
https://notcve.org/view.php?id=CVE-2018-8914
10 May 2018 — SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter. Vulnerabilidad de inyección SQL en UPnP DMA en Synology Media Server en versiones anteriores a la 1.7.6-2842 y anteriores a la 1.4-2654 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro ObjectID. • https://www.synology.com/en-global/support/security/Synology_SA_18_04 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2017-16567 – Logitech Media Server 7.9.0 - 'favorites' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16567
07 Nov 2017 — Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a "favorite." Una vulnerabilidad Cross-Site Scripting (XSS) en Logitech Media Server 7.9.0 permite que atacantes remotos inyecten scripts web o HTML arbitrarios a través de "favorite". Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently ... • https://packetstorm.news/files/id/144906 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2017-16568 – Logitech Media Server 7.9.0 - 'Radio URL' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16568
07 Nov 2017 — Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a radio URL. Una vulnerabilidad Cross-Site Scripting (XSS) en Logitech Media Server 7.9.0 permite que atacantes remotos inyecten scripts web o HTML arbitrarios a través de una URL radio. Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScrip... • https://packetstorm.news/files/id/144906 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 1CVE-2017-15687 – Logitech Media Server - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-15687
23 Oct 2017 — DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. Existe Cross-Site Scripting (XSS) basado en DOM en Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0 y 7.9.1 mediante una URI manipulada. • https://www.exploit-db.com/exploits/43024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 3%CPEs: 27EXPL: 0CVE-2017-5878
https://notcve.org/view.php?id=CVE-2017-5878
08 Jun 2017 — The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data. Los unmarshallers AMF en Red5 Media Server en versiones anteriores a la 1.0.8 no restringen las clases para las que realizan deserialización, lo que permite que atacantes remotos ejecuten código arbitrario mediante datos Java serializados manipulados. • http://www.openwall.com/lists/oss-security/2017/05/22/2 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 39%CPEs: 1EXPL: 2CVE-2017-6427 – Evostream Media Server 1.7.1 (x64) - Denial of Service
https://notcve.org/view.php?id=CVE-2017-6427
07 Mar 2017 — A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request. Se ha descubierto un desbordamiento de búfer en EvoStream Media Server 1.7.1. Una solicitud HTTP manipulada con un encabezado malicioso causara una caída. • https://packetstorm.news/files/id/141506 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 3CVE-2014-9304 – Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-9304
07 Dec 2014 — Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server. Plex Media Server anterior a 0.9.9.3 permite a atacantes remotos evadir la lista blanca del servidor web, realizar ataques de SSRF y ejecutar acciones administrativas arbitrarias a través de múltiples cabeceras... • https://www.exploit-db.com/exploits/31983 • CWE-264: Permissions, Privileges, and Access Controls •