Xitro01

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.7.12.0 **Description** The issue allows for a login bypass attack by setting the `X-Forwarded-For` header to a local IP address. This enables unauthorized access without proper credentials. **Recommendations** For versions prior to 4.7.12.0, update to version 4.7.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Emby Server to minimize the risk of exploitation. Avoid using the `X-Forwarded-For` header in authentication processes until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.6.0.50 **Description** The issue concerns a Cross Site Scripting (XSS) vulnerability. It can be exploited via a crafted GET request to the "/web" API endpoint. **Recommendations** For Emby Server versions prior to 4.6.0.50, update to version 4.6.0.50 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.7.12 Emby Server Beta versions prior to 4.8.31 **Description** This issue may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination, allowing logging in without a password or viewing a list of user accounts that may have no password configured. Impacted are all Emby Server systems that are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. **Recommendations** For Emby Server versions prior to 4.7.12, update to version 4.7.12 or later to resolve the issue. For Emby Server Beta versions prior to 4.8.31, update to version 4.8.31 or later to resolve the issue. As a temporary workaround, consider tightening the account login configuration for administrative users to minimize the risk of exploitation. Restrict access to the Emby Server system to only necessary users and networks.

**Nome do software vulnerável e versões afetadas** Spotweb versões 1.5.1 e anteriores **Descrição** O problema está relacionado a uma vulnerabilidade de Cross Site Scripting (XSS) no arquivo SpotPage login.php. Essa vulnerabilidade permite que invasores remotos injetem scripts da web ou HTML arbitrários por meio do parâmetro `data[performredirect]`. **Recomendações** Para as versões 1.5.1 e anteriores do Spotweb, considere desativar o acesso ao arquivo SpotPage login.php até que uma correção esteja disponível. Como solução temporária, restrinja o uso do parâmetro `data[performredirect]` no endpoint da API afetado para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.