Approved changes feed: RSS · Atom
cpe:2.3:a:owncast_project:owncast:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Owncast Project (9b05d069-ddf3-542e-8984-657658400fed) |
|---|---|
| Product | Owncast (c263fb93-61c0-5347-ab54-95c8620dc018) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/gilyas/owncast |
purl2cpe | 2026-06-01 10:11:22.393476 |
pkg:github/owncast/owncast |
purl2cpe | 2026-06-01 10:11:22.393478 |
pkg:github/xhumiq/owncast |
purl2cpe | 2026-06-01 10:11:22.393479 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-31450 |
vulnerable | 2026-06-08 06:35:31.545633 |
Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
LOW (2.7)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
Published: 2024-04-19T18:59:19.526Z
Updated: 2024-08-02T01:52:56.997Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29026 |
vulnerable | 2026-06-08 06:33:28.421945 |
Owncast cross origin request
HIGH (8.2)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.
Published: 2024-03-20T21:55:22.872Z
Updated: 2024-08-02T01:03:51.653Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3188 |
vulnerable | 2026-06-08 06:09:38.804897 |
Server-Side Request Forgery (SSRF) in owncast/owncast
HIGH (8.3)
Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
Published: 2023-06-10T00:00:00.000Z
Updated: 2025-01-06T17:11:32.042Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3751 |
vulnerable | 2026-06-08 05:48:22.266931 |
SQL Injection in owncast/owncast
HIGH (8.8)
SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.
Published: 2022-11-29T00:00:00.000Z
Updated: 2025-04-25T14:55:25.221Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39183 |
vulnerable | 2026-06-08 05:33:49.112837 |
Unsafe inline XSS Owncast
HIGH (8.2)
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
Published: 2021-12-14T20:05:12.000Z
Updated: 2024-08-04T01:58:18.143Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.