CVE-2024-51490 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users… |
CVE-2024-51489 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51488 | Medium | 5.4 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens… |
CVE-2024-51487 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51486 | Medium | 5.5 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users c… |
CVE-2024-51485 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-51484 | High | 8.1 | 2024-11-11 | Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens w… |
CVE-2024-47828 | Medium | 5.3 | 2024-10-09 | ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.)… |
CVE-2024-47184 | Medium | 6.1 | 2024-09-27 | Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross… |
CVE-2024-41665 | Medium | 5.5 | 2024-07-23 | Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This… |
CVE-2024-28853 | Low | 3.9 | 2024-03-27 | Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before v6.3.1 allows a re… |
CVE-2024-28852 | Medium | 6.1 | 2024-03-27 | Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the… |
CVE-2023-0771 | High | 8.8 | 2023-02-10 | SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop. |
CVE-2023-0606 | Medium | 6.1 | 2023-02-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. |
CVE-2022-4665 | High | 8.8 | 2022-12-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6. |
CVE-2021-32644 | Medium | 6.4 | 2021-06-22 | Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code… |
CVE-2020-15153 | High | 8.2 | 2021-04-30 | Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workarou… |
CVE-2021-21399 | Critical | 9.1 | 2021-04-13 | Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic A… |
CVE-2019-12386 | Medium | 5.4 | 2019-08-22 | An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflect… |
CVE-2019-12385 | High | 8.8 | 2019-08-22 | An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php sear… |
CVE-2017-18375 | High | 8.8 | 2019-05-24 | Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php. |
CVE-2008-3929 | | | 2008-09-04 | gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file. |
CVE-2007-4438 | | | 2007-08-20 | Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors. |
CVE-2007-4437 | | | 2007-08-20 | SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match parameter. NOTE: s… |
CVE-2006-5668 | | | 2006-11-03 | Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain gues… |