Viliald

The issue is related to a Cross-site Scripting (XSS) attack that can be performed when importing malicious CSV content. This can be done by filling malicious code in a CSV content. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

A CSRF issue can be performed on CSV import simulation in Combodo iTop, allowing an attacker to forge malicious requests. There are no known workarounds for this issue.

A Cross-Site Request Forgery (CSRF) attack can be performed to delete objects such as playlists and smartlists. This attack forces authenticated users to submit a request to a web application against which they are currently authenticated. The issue can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user, resulting in the deletion of the user's playlist without their consent. Any user with an active session who is tricked into submitting a malicious request is impacted.

Navidrome is an open source web-based music collection server and streamer. The issue is a parameter tampering vulnerability where an attacker can manipulate parameter values in the HTTP requests, allowing them to impersonate another user. This can be done by changing the parameter values in the body, and the attacker must be able to intercept HTTP traffic for this attack. Each known user is impacted, and an attacker can obtain the `ownerId` from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated.

iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value.