Products: 1
Vulnerabilities: 3
Known Exploited: 0
3
Critical Level Threats
0
High Level Threats
0
Medium Level Threats
0
Low Level Threats
Vulnerabilities
100806040200
JanFebMarAprMayJunJulAugSepOctNovDec
Critical Level Threats
High Level Threats
Medium Level Threats
Low Level Threats
Products Security index
Actions
Items Per Page
Vulnerabilities
CVE-2019-10908
In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.
Last Modified: Nov 21, 2024
Published: Apr 07, 2019
CVE-2019-10907
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
Last Modified: Nov 21, 2024
Published: Apr 07, 2019
CVE-2018-20222
XXE issue in Airsonic before 10.1.2 during parse.
Last Modified: Nov 21, 2024
Published: Apr 04, 2019
Items Per Page
