Threats tagged 'ghsa-66jv-wghm-3798'

AzuraCast versions through 0.23.8 have a remote code execution vulnerability that allows authenticated station managers to inject malicious Supervisor configurations via the station timezone field. By submitting a specially crafted timezone string containing newlines to the profile edit API, an attacker can define a new Supervisor program that executes operating system commands as root when the configuration regenerates.