Cherry Music Cross-site Scripting (XSS) vulnerability

MEDIO 5.4CVE-2015-8310 · GHSA-4wcc-jv3p-prqw · PYSEC-2017-100 · Published 27/03/2017 · updated 17/06/2026

In breve

CVE-2015-8310 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda cherrymusic, cherrymusic (fomori).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.85%, superiore al 58.3% delle vulnerabilità.
Correzione: aggiornare a 0.36.0 o successiva.

Package	Affected versions	Patched versions
cherrymusic PyPI	`< 0.36.0`	`0.36.0`
cherrymusic fomori	`≤ 0.35.2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-8310 · ADVISORY
devsnd/cherrymusic · WEB
devsnd/cherrymusic commit 62dec34 · WEB
devsnd/cherrymusic · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227183347/http://www.securityfocus.com/bid/97148 · WEB
fomori.org/cherrymusic/Changes.html · WEB
securityfocus.com/bid/97148
GitHub Advisory GHSA-4wcc-jv3p-prqw · ADVISORY

Altre vulnerabilità di cherrymusic

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cherrymusic

PyPI

< 0.36.0

0.36.0

cherrymusic

fomori

≤ 0.35.2

No fix yet

Description

NVD description