Xitro01

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.7.12.0 **Description** The issue allows for a login bypass attack by setting the `X-Forwarded-For` header to a local IP address. This enables unauthorized access without proper credentials. **Recommendations** For versions prior to 4.7.12.0, update to version 4.7.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Emby Server to minimize the risk of exploitation. Avoid using the `X-Forwarded-For` header in authentication processes until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.6.0.50 **Description** The issue concerns a Cross Site Scripting (XSS) vulnerability. It can be exploited via a crafted GET request to the "/web" API endpoint. **Recommendations** For Emby Server versions prior to 4.6.0.50, update to version 4.6.0.50 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Emby Server versions prior to 4.7.12 Emby Server Beta versions prior to 4.8.31 **Description** This issue may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination, allowing logging in without a password or viewing a list of user accounts that may have no password configured. Impacted are all Emby Server systems that are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. **Recommendations** For Emby Server versions prior to 4.7.12, update to version 4.7.12 or later to resolve the issue. For Emby Server Beta versions prior to 4.8.31, update to version 4.8.31 or later to resolve the issue. As a temporary workaround, consider tightening the account login configuration for administrative users to minimize the risk of exploitation. Restrict access to the Emby Server system to only necessary users and networks.

**Name of the Vulnerable Software and Affected Versions** Spotweb versions 1.5.1 and below **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability in the SpotPage login.php file. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `data[performredirect]` parameter. **Recommendations** For Spotweb versions 1.5.1 and below, consider disabling access to the SpotPage login.php file until a patch is available. As a temporary workaround, restrict the use of the `data[performredirect]` parameter in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.