Transmission
Monthly
A permissive CORS misconfiguration in Transmission 4.0.0 through 4.1.2 exposes the RPC anti-CSRF token (X-Transmission-Session-Id) to any web origin, so a malicious page can read the token from the 409 handshake response and replay it to drive the RPC interface as the user. Successful replay allows settings tampering, download-directory changes and torrent or data deletion, and escalates to code execution where the script-torrent-done feature is usable, but only defeats the anti-CSRF check - an RPC password or an enabled IP whitelist blocks the replay. Exploitation requires the RPC web server (default port 9091) to be reachable from the victim's browser and the victim to visit the attacker's page; no KEV entry exists, EPSS is low at 0.53% (44th percentile), and a public researcher write-up with a PoC reference exists but is not verified here as working exploit code.
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) created by, or. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available.
A permissive CORS misconfiguration in Transmission 4.0.0 through 4.1.2 exposes the RPC anti-CSRF token (X-Transmission-Session-Id) to any web origin, so a malicious page can read the token from the 409 handshake response and replay it to drive the RPC interface as the user. Successful replay allows settings tampering, download-directory changes and torrent or data deletion, and escalates to code execution where the script-torrent-done feature is usable, but only defeats the anti-CSRF check - an RPC password or an enabled IP whitelist blocks the replay. Exploitation requires the RPC web server (default port 9091) to be reachable from the victim's browser and the victim to visit the attacker's page; no KEV entry exists, EPSS is low at 0.53% (44th percentile), and a public researcher write-up with a PoC reference exists but is not verified here as working exploit code.
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) created by, or. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available.