Serviio Pro
Approved changes feed: RSS · Atom
cpe:2.3:a:serviio:serviio_pro:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Serviio (c46d2744-3135-5eee-b7ae-c9ba301d1f1a) |
|---|---|
| Product | Serviio Pro (0eb0aff2-322c-5157-a221-efbceb126195) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-20220 |
vulnerable | 2026-06-08 05:09:23.502239 |
Serviio PRO 1.8 Unauthenticated Password Change via REST API
HIGH (7.5)
Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.
Published: 2026-03-15T18:34:28.354Z
Updated: 2026-03-16T14:20:17.530Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-20219 |
vulnerable | 2026-06-08 05:09:23.501914 |
Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser
MEDIUM (6.1)
Serviio PRO 1.8 DLNA Media Streaming Server contains a DOM-based cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads. Attackers can craft URLs with malicious input that is read from document.location and passed to document.write() in the mediabrowser component to execute code in a user's browser context.
Published: 2026-03-15T18:34:27.373Z
Updated: 2026-05-24T01:36:12.339Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-20218 |
vulnerable | 2026-06-08 05:09:23.501575 |
Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path
HIGH (7.8)
Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improper directory permissions with full access for the Users group allow authenticated users to replace the executable file with arbitrary binaries, enabling privilege escalation during service startup or system reboot.
Published: 2026-03-15T18:34:25.800Z
Updated: 2026-03-16T14:20:17.881Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-20217 |
vulnerable | 2026-06-08 05:09:23.501185 |
Serviio PRO 1.8 REST API Information Disclosure
HIGH (7.5)
Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated attackers to access sensitive information. Remote attackers can send specially crafted requests to the REST API endpoints to retrieve potentially sensitive configuration data without authentication.
Published: 2026-03-15T18:34:24.635Z
Updated: 2026-03-16T14:20:18.020Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.