12 results · Feed
-
High 8.8
Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response …
-
Medium 5.3
transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
-
Unscored —
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of se…
-
Unscored —
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
-
Unscored —
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified imp…
-
Unscored —
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access co…
-
Unscored —
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote…
-
Unscored —
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allo…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attacker…
-
Unscored —
Multiple stack-based buffer overflows in the tr_magnetParse function in libtransmission/magnet.c in Transmission 1.91 a…
-
Unscored —
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remot…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attac…