8646 matches found
CVE-2026-25253-research
Prueba de Concepto CVE-2026-25253 RCE con un solo clic en OpenClaw mediante Cross-Site WebSocket Hijacking. AVISO LEGAL: Este código se proporciona únicamente con fines de investigación de seguridad autorizada y educativos. El uso de este código contra sistemas sin permiso escrito explícito es...
CVE-2026-41940
Basado en Watch Tower POC , Soporta acceso directo a shell vía websocket , y añadir claves raíz de API para persistencia...
CVE-2026-25253
CVE-2026-25253: RCE con un solo clic en OpenClaw mediante el robo de tokens de autenticación Software afectado: OpenClaw clawbot AVISO LEGAL: Este código y análisis se proporcionan únicamente con fines de investigación de seguridad autorizada y educativos. El uso de este exploit contra sistemas s...
openclaw-vuln-report
Informe de Análisis de Vulnerabilidad de OpenClaw Interpretación en chino de la vulnerabilidad de seguridad CVE-2026-25253 Lectura en línea GitHub Pages: https://joseph19820124.github.io/openclaw-vuln-report/ Resumen de la vulnerabilidad CVE : CVE-2026-25253 Puntuación : CVSS 8.8 Alta Tipo :...
CVE-2026-39363
CVE-2026-39363 Vulnerabilidad de Lectura Arbitraria de Archivos en el WebSocket del Servidor de Desarrollo de Vite Resumen de la Vulnerabilidad Atributo| Información ---|--- ID CVE| CVE-2026-39363 ID GHSA| GHSA-p9ff-h696-f583 Tipo de Vulnerabilidad| Arbitrary File Read Lectura Arbitraria de...
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
ImpactThe WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
Impactdjust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...
djust has an authorization bypass on the WebSocket/SSE mount path
ImpactThe live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — an...
Chainlit contains a session hijacking vulnerability
Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the...
CVE-2026-39987-lab-or-marimo-cve-lab
Guía de Laboratorio CVE-2026-39987 Ejecución Remota de Código Pre-Autenticación mediante Bypass de Autenticación en WebSocket de Terminal Un laboratorio Docker educativo para comprender, reproducir y parchear esta vulnerabilidad crítica en marimo. Tabla de Contenidos Descripción General...
tomcat: Apache Tomcat: Denial of Service via WebSocket chat example
A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...
tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination
A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...
cve-2026-69243-poc-aiohttp-smuggling
CVE-2026-69243 — Contrabando de solicitudes en aiohttp CWE-444 Contrabando de solicitudes mediante una actualización WebSocket rechazada en aiohttp O compila la versión en Rust cero dependencias, solo std: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd...
CVE-2026-39363
CVE-2026-39363 — PoC de lectura arbitraria de archivos en Vite Dev Server PoC ejecutable directamente para GHSA-p9ff-h696-f583. A través de un WebSocket HMR sin autenticación, invoca fetchModule, eludiendo la restricción server.fs.allow de la capa HTTP, para leer archivos arbitrarios en la máquin...
CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header
CVE-2026-1010 – Contrabando de conexiones WebSocket Descripción general Un proxy inverso y un backend no se ponen de acuerdo sobre cómo analizar una solicitud HTTP con un encabezado de actualización WebSocket malformado. El proxy la trata como una sola solicitud, mientras que el backend la...
go-zeek-broker-ws
Biblioteca de interfaz websocket de Zeek Broker para Golang Esta biblioteca implementa la interfaz websocket de Zeek Broker. Se proporcionan funciones auxiliares con asignaciones razonables entre los tipos de Zeek y Go. Uso La biblioteca contiene dos paquetes: encoding encoding modela la estructu...