Lizardbyte

Sunshine

10 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7

CVE-2025-54081

Exploit
  • EPSS 0.01%
  • Veröffentlicht 23.09.2025 19:15:39
  • Zuletzt bearbeitet 08.10.2025 17:48:27

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Ser...

7.8

CVE-2025-10199

  • EPSS 0.02%
  • Veröffentlicht 09.09.2025 17:30:19
  • Zuletzt bearbeitet 03.11.2025 19:15:44

A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.

7.8

CVE-2025-10198

  • EPSS 0.01%
  • Veröffentlicht 09.09.2025 17:28:14
  • Zuletzt bearbeitet 20.01.2026 17:15:48

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.

8.8

CVE-2025-53095

  • EPSS 0.03%
  • Veröffentlicht 01.07.2025 01:33:22
  • Zuletzt bearbeitet 22.08.2025 13:44:40

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to craft a malicious web page t...

6.1

CVE-2025-53096

  • EPSS 0.04%
  • Veröffentlicht 01.07.2025 01:33:01
  • Zuletzt bearbeitet 22.08.2025 14:28:45

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious w...

8.1

CVE-2024-51738

  • EPSS 1.84%
  • Veröffentlicht 20.01.2025 16:15:27
  • Zuletzt bearbeitet 11.09.2025 21:33:04

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker t...

5.3

CVE-2024-45407

Exploit
  • EPSS 0.37%
  • Veröffentlicht 10.09.2024 16:15:20
  • Zuletzt bearbeitet 20.09.2024 16:18:46

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pa...

2.9

CVE-2024-31226

  • EPSS 0.1%
  • Veröffentlicht 16.05.2024 19:15:49
  • Zuletzt bearbeitet 11.09.2025 21:41:19

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`...

5.9

CVE-2024-31221

Exploit
  • EPSS 0.09%
  • Veröffentlicht 08.04.2024 15:15:08
  • Zuletzt bearbeitet 11.09.2025 21:41:40

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily ...

7.3

CVE-2024-31220

  • EPSS 0.19%
  • Veröffentlicht 05.04.2024 15:15:08
  • Zuletzt bearbeitet 11.09.2025 21:41:57

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed...