Airsonic_project Airsonic
3 CVEs affecting Airsonic_project Airsonic. Latest disclosed: 2019-04-07. Critical: 3, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10908 | Critical | 9.8 | 2019-04-07 | In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG… |
CVE-2019-10907 | Critical | 9.8 | 2019-04-07 | Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to captur… |
CVE-2018-20222 | Critical | 9.8 | 2019-04-04 | XXE issue in Airsonic before 10.1.2 during parse. |