Plex

Media Server

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2021-33959

Exploit
  • EPSS 15.04%
  • Veröffentlicht 18.01.2023 14:15:10
  • Zuletzt bearbeitet 04.04.2025 18:15:41

Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

7

CVE-2021-42835

Exploit
  • EPSS 1.18%
  • Veröffentlicht 08.12.2021 15:15:10
  • Zuletzt bearbeitet 21.11.2024 06:28:12

An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allow...

8.8

CVE-2020-5742

Exploit
  • EPSS 1.42%
  • Veröffentlicht 15.06.2020 20:15:11
  • Zuletzt bearbeitet 21.11.2024 05:34:31

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.

7.2

CVE-2020-5741

Warnung Medienbericht Exploit
  • EPSS 72.94%
  • Veröffentlicht 08.05.2020 13:15:11
  • Zuletzt bearbeitet 31.10.2025 22:10:54

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

7.8

CVE-2020-5740

Exploit
  • EPSS 0.75%
  • Veröffentlicht 22.04.2020 16:15:13
  • Zuletzt bearbeitet 21.11.2024 05:34:30

Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges.

8.8

CVE-2019-19141

  • EPSS 4.72%
  • Veröffentlicht 19.12.2019 23:15:16
  • Zuletzt bearbeitet 21.11.2024 04:34:15

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of meth...

6.5

CVE-2018-21031

Exploit
  • EPSS 2.06%
  • Veröffentlicht 18.11.2019 17:15:10
  • Zuletzt bearbeitet 21.11.2024 04:02:44

Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Serve...

9.8

CVE-2018-13415

Exploit
  • EPSS 31.81%
  • Veröffentlicht 13.08.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 03:47:03

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the...

7.5

CVE-2014-9304

Exploit
  • EPSS 8.11%
  • Veröffentlicht 07.12.2014 21:59:05
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processe...

5

CVE-2014-9181

Exploit
  • EPSS 9.48%
  • Veröffentlicht 02.12.2014 16:59:18
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (d...