Owncast Project

owncast_project

6 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-31450 1Owncast Project 1Owncast Jun 17, 2026 Apr 19, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API a...Show more Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.Show less
CVE-2024-29026 1Owncast Project 1Owncast Jun 17, 2026 Mar 20, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privile...Show more Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.Show less
CVE-2023-46480 1Owncast Project 1Owncast Jun 17, 2026 Nov 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
CVE-2023-3188 1Owncast Project 1Owncast Jun 17, 2026 Jun 10, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
CVE-2022-3751 1Owncast Project 1Owncast Jun 17, 2026 Nov 29, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
CVE-2021-39183 1Owncast Project 1Owncast Jun 17, 2026 Dec 14, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsaf...Show more Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.Show less