7 results · Feed
-
Critical 9.0
qui CORS Misconfiguration: Arbitrary Origins Trusted
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make au…
-
Medium 4.0
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidg…
-
High 8.1CVE-2024-51774 Public exploit
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
-
Critical 9.8
qBittorrent Web UI Default Credentials Lead to RCE
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the d…
-
Unscored —
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows comma…
-
Unscored —
WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
-
Unscored —
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.