Medium severity5.3NVD Advisory· Published Dec 10, 2019· Updated Jun 17, 2026

CVE-2019-19251

Description

The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts.

Affected products

Last.fm/Last.fm Scrobblerdescription
lastfm/Last.fm Scrobblerllm-create
Range: <=2.1.39

Patches

Vulnerability mechanics

References

getsatisfaction.com/lastfm/topics/why-doesnt-the-macos-client-enable-ssl-by-default-c1nh5k1s054aknvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000