CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19141
https://notcve.org/view.php?id=CVE-2019-19141
19 Dec 2019 — The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal, uploading an SSH authorized_keys file there, and logging into the host as the Plex user via SSH. La funcionalidad Camera Upload en P... • https://forums.plex.tv/t/security-camera-upload/507289 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0CVE-2017-5878
https://notcve.org/view.php?id=CVE-2017-5878
08 Jun 2017 — The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data. Los unmarshallers AMF en Red5 Media Server en versiones anteriores a la 1.0.8 no restringen las clases para las que realizan deserialización, lo que permite que atacantes remotos ejecuten código arbitrario mediante datos Java serializados manipulados. • http://www.openwall.com/lists/oss-security/2017/05/22/2 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3CVE-2014-9304 – Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-9304
07 Dec 2014 — Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handler in the backend web server. Plex Media Server anterior a 0.9.9.3 permite a atacantes remotos evadir la lista blanca del servidor web, realizar ataques de SSRF y ejecutar acciones administrativas arbitrarias a través de múltiples cabeceras... • https://www.exploit-db.com/exploits/31983 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 3CVE-2014-9181 – Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-9181
02 Dec 2014 — Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to resources/. Múltiples vulnerabilidades de salto de directorio en Plex Media Server anterior a 0.9.9.3 permiten a atacantes remotos leer ficheros arbitrarios a través de un .. (punto punto) en la URI en (1) manage/ o (2) web/ o usuarios remo... • https://www.exploit-db.com/exploits/31983 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 7%CPEs: 1EXPL: 2CVE-2007-6036 – LIVE555 Media Server 2007.11.1 - ParseRTSPRequestString Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-6036
20 Nov 2007 — The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used during memory allocation. La función parseRTSPRequestString en LIVE555 Media Server 2007.11.01 y anteriores permite a atacantes remotos provocar denegación de servicio (caida de demonio) a través de una consulta pequeña RTSP, lo cual deriba en un número negativo para ser usado a lo largo de loc... • https://www.exploit-db.com/exploits/30776 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 7%CPEs: 1EXPL: 1CVE-2007-5824 – Firefly Media Server 0.2.4 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-5824
05 Nov 2007 — webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function. webserver.c en mt-dappd in Firefly Media Server 0.2.4 y anteriores permite a atacantes remotos provocar denegación d... • https://www.exploit-db.com/exploits/4600 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 10%CPEs: 1EXPL: 0CVE-2007-5825
https://notcve.org/view.php?id=CVE-2007-5825
05 Nov 2007 — Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the "Authorization: Basic" HTTP header line. Vulnerabilidad de formato de cadena en la función ws_addarg en webserver.c en mt-dappd en Firefly Media Server 0.2.4 y anteriores permite a atacantes remoto... • http://bugs.gentoo.org/show_bug.cgi?id=200110 • CWE-134: Use of Externally-Controlled Format String •