Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
plex media server vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2019-19141
The Camera Upload functionality in Plex Media Server up to and including 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as (on a...
Plex Media Server
NA
CVE-2014-9304
Plex Media Server prior to 0.9.9.3 allows remote malicious users to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers to system/proxy, which are inconsistently processed by the request handl...
Plex Media Server
1 EDB exploit
7.8
CVSSv3
CVE-2020-5740
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated malicious user to execute arbitrary Python code with SYSTEM privileges.
Plex Media Server
7.2
CVSSv3
CVE-2020-5741
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated malicious user to execute arbitrary Python code.
Plex Media Server
8.8
CVSSv3
CVE-2020-5742
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.
Plex Media Server
NA
CVE-2014-9181
Multiple directory traversal vulnerabilities in Plex Media Server prior to 0.9.9.3 allow remote malicious users to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) web/ or remote authenticated users to read arbitrary files via a .. (dot dot) in the URI to ...
Plex Media Server
1 EDB exploit
7.5
CVSSv3
CVE-2021-33959
Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
Plex Media Server
1 Github repository
7
CVSSv3
CVE-2021-42835
An issue exists in Plex Media Server up to and including 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the malicious user to in...
Plex Media Server
1 Github repository
9.8
CVSSv3
CVE-2018-13415
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same perm...
Plex Media Server 1.13.2.5154
1 EDB exploit
6.5
CVSSv3
CVE-2018-21031
Tautulli versions 2.1.38 and below allows remote malicious users to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c ...
Plex Media Server 1.18.2.2029-36236cc4c
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
buffer overflow
type confusion
server-side request forgery
CVE-2024-38440
CVE-2024-27801
CVE-2024-5868
CVE-2024-0582
CVE-2024-37643
CVE-2024-3105
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started