Airsonic

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2019-10908 Apr 07, 14:29 CRITICAL PATCH Act Now

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Privilege Escalation Apache Java Airsonic Airsonic Project

NVD GitHub

CVSS 3.0

9.8

EPSS

1.6%

CVE-2019-10907 Apr 07, 14:29 CRITICAL PATCH Act Now

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Java Information Disclosure Airsonic Airsonic Project

NVD GitHub

CVSS 3.0

9.8

EPSS

0.9%

CVE-2019-10908

EPSS 2% CVSS 9.8

CRITICAL PATCH Act Now

Privilege Escalation Apache Java +2

NVD GitHub

CVE-2019-10907

EPSS 1% CVSS 9.8

CRITICAL PATCH Act Now

Java Information Disclosure Airsonic +1

NVD GitHub