Sohu
Monthly
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 affects the index function of AppDataMigrateController, allowing remote attackers to inject arbitrary web scripts. Exploit code is publicly available, but no vendor patch has been released. EPSS indicates low exploitation probability (0.03%), and the vulnerability requires authentication and user interaction.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows remote attackers to inject malicious scripts via the LoginController initialization function, requiring user interaction to execute. The vulnerability has a public exploit available but represents low real-world risk due to CVSS 2.1 score, minimal EPSS exploitation probability (0.04%), and the requirement for user click-through. The vendor has not responded to early disclosure through a GitHub issue.
Stored cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows low-privileged authenticated attackers to inject JavaScript payloads via the doMachineList or doPodList functions. The vulnerability has a publicly available exploit but is not known to be actively exploited, and the EPSS likelihood is very low (0.06%). Affected users should restrict access and apply input sanitization until a vendor patch is released.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privileged authenticated users to inject malicious scripts via the doQuartzList function in QuartzManageController.java, affecting users who interact with crafted content. The vulnerability requires high privileges (PR:H) and user interaction (UI:P), limiting real-world impact despite remote network accessibility. Public exploit code is available, but EPSS exploitation probability is exceptionally low at 0.04% (11th percentile), suggesting the attack requires substantial prerequisites unlikely to occur in typical deployments.
Cross-site scripting (XSS) vulnerability in CacheCloud's ResourceController index endpoint permits authenticated administrators to inject arbitrary web scripts. Attackers with high privileges can exploit this remotely, though user interaction is required. Exploit code is publicly available, but no active exploitation has been confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privilege users to inject malicious scripts via the taskQueueList function in TaskController.java, requiring user interaction for exploitation. The vulnerability has publicly available exploit details and a low EPSS score of 0.04%, indicating minimal real-world exploitation risk despite the public disclosure.
Cross-site scripting in SohuTV CacheCloud up to 3.2.0 allows remote attackers to inject arbitrary web scripts or HTML via the redirectNoPower function in WebResourceController.java. The flaw requires a low-privileged authenticated user to interact with a crafted link. Public exploit code exists, but no active exploitation has been confirmed.
Stored/reflected cross-site scripting in SohuTV CacheCloud up to 3.2.0 enables authenticated administrators to inject web scripts via statistics endpoints. Exploit code is publicly available, but high privileges and user interaction severely limit impact.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 permits a low‑privileged attacker to inject arbitrary JavaScript through the app management controller. An authenticated user can craft a malicious request to doAppList or appCommandAnalysis that, when viewed by another user (likely an administrator), executes script in the victim’s browser. Exploitation requires user interaction and is not yet seen in the wild, and EPSS indicates very low likelihood of widespread targeting.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows remote authenticated attackers with low privileges to inject arbitrary web script or HTML via the doAppAuditList function. A victim must visit a crafted audit listing page for the script to execute, which can lead to session hijacking or page defacement. Public exploit code is available but EPSS indicates a low probability of widespread exploitation.
Cross-site scripting (XSS) in SohuTV
Cross-site scripting in SohuTV CacheCloud version 3.2.0 and earlier allows remote authenticated attackers with low privileges to inject arbitrary scripts via the preview function of the RedisConfigTemplateController. Public exploit code exists, but the project has not yet released a fix. The EPSS score is very low (0.03%) and no active exploitation is confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 affects the index function of AppDataMigrateController, allowing remote attackers to inject arbitrary web scripts. Exploit code is publicly available, but no vendor patch has been released. EPSS indicates low exploitation probability (0.03%), and the vulnerability requires authentication and user interaction.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows remote attackers to inject malicious scripts via the LoginController initialization function, requiring user interaction to execute. The vulnerability has a public exploit available but represents low real-world risk due to CVSS 2.1 score, minimal EPSS exploitation probability (0.04%), and the requirement for user click-through. The vendor has not responded to early disclosure through a GitHub issue.
Stored cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows low-privileged authenticated attackers to inject JavaScript payloads via the doMachineList or doPodList functions. The vulnerability has a publicly available exploit but is not known to be actively exploited, and the EPSS likelihood is very low (0.06%). Affected users should restrict access and apply input sanitization until a vendor patch is released.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privileged authenticated users to inject malicious scripts via the doQuartzList function in QuartzManageController.java, affecting users who interact with crafted content. The vulnerability requires high privileges (PR:H) and user interaction (UI:P), limiting real-world impact despite remote network accessibility. Public exploit code is available, but EPSS exploitation probability is exceptionally low at 0.04% (11th percentile), suggesting the attack requires substantial prerequisites unlikely to occur in typical deployments.
Cross-site scripting (XSS) vulnerability in CacheCloud's ResourceController index endpoint permits authenticated administrators to inject arbitrary web scripts. Attackers with high privileges can exploit this remotely, though user interaction is required. Exploit code is publicly available, but no active exploitation has been confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privilege users to inject malicious scripts via the taskQueueList function in TaskController.java, requiring user interaction for exploitation. The vulnerability has publicly available exploit details and a low EPSS score of 0.04%, indicating minimal real-world exploitation risk despite the public disclosure.
Cross-site scripting in SohuTV CacheCloud up to 3.2.0 allows remote attackers to inject arbitrary web scripts or HTML via the redirectNoPower function in WebResourceController.java. The flaw requires a low-privileged authenticated user to interact with a crafted link. Public exploit code exists, but no active exploitation has been confirmed.
Stored/reflected cross-site scripting in SohuTV CacheCloud up to 3.2.0 enables authenticated administrators to inject web scripts via statistics endpoints. Exploit code is publicly available, but high privileges and user interaction severely limit impact.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 permits a low‑privileged attacker to inject arbitrary JavaScript through the app management controller. An authenticated user can craft a malicious request to doAppList or appCommandAnalysis that, when viewed by another user (likely an administrator), executes script in the victim’s browser. Exploitation requires user interaction and is not yet seen in the wild, and EPSS indicates very low likelihood of widespread targeting.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows remote authenticated attackers with low privileges to inject arbitrary web script or HTML via the doAppAuditList function. A victim must visit a crafted audit listing page for the script to execute, which can lead to session hijacking or page defacement. Public exploit code is available but EPSS indicates a low probability of widespread exploitation.
Cross-site scripting (XSS) in SohuTV
Cross-site scripting in SohuTV CacheCloud version 3.2.0 and earlier allows remote authenticated attackers with low privileges to inject arbitrary scripts via the preview function of the RedisConfigTemplateController. Public exploit code exists, but the project has not yet released a fix. The EPSS score is very low (0.03%) and no active exploitation is confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.