Lyrion Music Server 9.2.0 (search.*) Multiple Script Insertions Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and...

Lyrion Music Server 9.2.0 Path Traversal File Read Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and serve (stream)...

Lyrion Music Server 9.2.0 Arbitrary Directory Listing Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and serve...

Lyrion Music Server 9.2.0 (metadata) Stored XSS Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and serve (stream)...

Lyrion Music Server 9.2.0 (server.log) Unauthenticated Stored XSS Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and...

Lyrion Music Server 9.2.0 (server.log) Unauthenticated Reflected XSS Vendor: LMS Community Product web page: https://www.lyrion.org Affected version 9.2.0 Summary: Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control...

Lightweight Music Server (LMS) 3.76.0 (metadata) Stored XSS Vendor: Emeric Poupon Product web page: https://github.com/epoupon/lms Affected version 3.76.0 Summary: LMS (Lightweight Music Server): A specific C++ based project focused on a low memory footprint, featuring built-in user...

Pachno 1.0.6 FileCache Deserialization Remote Code Execution Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project...

Pachno 1.0.6 (runSwitchUser()) Remote Vertical Privilege Escalation Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project...

Pachno 1.0.6 Wiki TextParser XXE Vulnerability Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue...

Pachno 1.0.6 Cross-Site Request Forgery Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking, and...

#!/usr/bin/env python3 # # # Pachno 1.0.6 (uploadfile) Unrestricted File Upload Remote Code Execution # # # Vendor: Daniel André Eikeland # Product web page: https://github.com/pachno/pachno # Affected version: 1.0.6 # # Summary: Pachno is an open-source collaboration platform (formerly known as...

Pachno 1.0.6 (return_to) Open Redirection Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking...

Pachno 1.0.6 Stored Cross-Site Scripting Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform (formerly known as The Bug Genie) designed for team project management, issue tracking...

#!/usr/bin/env/python3 # -*- coding: utf-8 -*- # # # Honeywell Trend IQ4xx BMS Controller Unauthenticated Remote Web-HMI Control And Lockout # # # Vendor: Honeywell International Inc. # Product web page: https://buildings.honeywell.com/gb/en/products/by-brand/trend/iq4-controllers # Affected...