Shoutcast Server

Vendor:

First CVE: Aug 20, 1999 · Active for 26 years

10

Total CVEs

More Total CVEs than 88% of tracked products

1.4

Avg CVEs / Year

Higher CVE frequency than 56% of tracked products

5.5

Avg CVSS

Higher Avg CVSS than 15% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Shoutcast Server over time

Volume of CVEsAvg CVSS Base Score

First CVE

Aug 20, 1999

26 years ago

Most Recent CVE

Mar 2, 2007

7,084 days ago

CVE Severity & Scoring

Shoutcast Server10 CVEs

20%

30%

50%

All CVEs352,231 CVEs

45%

40%

11%

LowMediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown10 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown10 (100.0%)

User Interaction

None0 (0.0%)

Unknown10 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown10 (100.0%)

Top CVEs

Signals from CVEs in this product scope (10 CVEs).

10 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2004-1373HIGH Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via format string specifiers in a	Dec 23, 2004	7.5	74	NO	YES
CVE-2002-0907HIGH Buffer overflow in SHOUTcast 1.8.9 and other versions before 1.8.12 allows a remote authenticated DJ to execute arbitrary code on the server via a long value in a header whose name	Oct 4, 2002	7.5	36	NO	YES
CVE-2007-1229MEDIUM Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming	Mar 2, 2007	4.3	21	NO	YES
CVE-2003-1174LOW Buffer overflow in NullSoft Shoutcast Server 1.9.2 allows local users to cause a denial of service via (1) icy-name followed by a long server name or (2) icy-url followed by a long	Dec 31, 2003	2.1	21	NO	YES
CVE-2002-0199HIGH Buffer overflow in admin.cgi for Nullsoft Shoutcast Server 1.8.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an argument with a lar	May 16, 2002	7.5	21	NO	NO
CVE-2006-3534HIGH Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary file	Jul 12, 2006	7.8	20	NO	NO
CVE-2001-1304MEDIUM Buffer overflow in SHOUTcast Server 1.8.2 allows remote attackers to cause a denial of service (crash) via several HTTP requests with a long (1) user-agent or (2) host HTTP header.	Aug 3, 2001	5.0	19	NO	NO
CVE-1999-1561HIGH Nullsoft SHOUTcast server stores the administrative password in plaintext in a configuration file (sc_serv.conf), which could allow a local user to gain administrative privileges o	Aug 20, 1999	7.2	18	NO	NO
CVE-2006-3007MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in SHOUTcast 1.9.5 allow remote attackers to inject arbitrary HTML or web script via the DJ fields (1) Description, (2) URL, (3)	Jun 13, 2006	4.3	14	NO	NO
CVE-2002-1470LOW SHOUTcast 1.8.9 and earlier allows local users to obtain the cleartext administrative password via a GET request to port 8001, which causes the password to be logged in the world-r	Apr 22, 2003	2.1	11	NO	NO

View all 10 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (10 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

1 CVE

10.0% of CVEs· 97th percentile

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

4 CVEs

40.0% of CVEs· 91st percentile

Social Chatter

Signals from CVEs in this product scope (10 CVEs).

Media Mentions

Signals from CVEs in this product scope (10 CVEs).

Top CNAs Publishing CVEs For Shoutcast Server

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
1.9.7	2	5.8	1.1%	1
1.9.5	2	6.0	2.0%	0
1.9.4	3	6.5	24.7%	1
1.9.2	3	5.5	1.9%	1
1.8.9	4	6.3	3.0%	1
1.8.3	3	6.8	2.5%	0
1.8.2	2	6.4	2.2%	0
1.7.1	2	6.0	2.0%	0