Filtered by vendor Owncast Project Subscriptions
Filtered by product Owncast Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-31450 1 Owncast Project 1 Owncast 2024-11-21 2.7 Low
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
CVE-2023-46480 1 Owncast Project 1 Owncast 2024-11-21 9.8 Critical
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
CVE-2023-3188 1 Owncast Project 1 Owncast 2024-11-21 6.5 Medium
Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
CVE-2022-3751 1 Owncast Project 1 Owncast 2024-11-21 9.8 Critical
SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
CVE-2021-39183 1 Owncast Project 1 Owncast 2024-11-21 8.2 High
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.