EUVD-2020-17787

Malware in sbrugna...

EUVD-2021-24319

Malware in sbrugna...

EUVD-2021-1233

Malware in sbrugna...

EUVD-2019-7960

Malware in sbrugna...

EUVD-2024-54549

Malicious code in bioql PyPI...

EUVD-2023-34299

Malicious code in bioql PyPI...

EUVD-2025-7066

Malicious code in bioql PyPI...

EUVD-2025-0225

Malicious code in bioql PyPI...

EUVD-2024-0618

Malicious code in bioql PyPI...

EUVD-2023-1957

Malicious code in bioql PyPI...

EUVD-2023-33072

Malicious code in bioql PyPI...

EUVD-2023-12942

Malicious code in bioql PyPI...

EUVD-2021-6870

Malicious code in bioql PyPI...

EUVD-2025-25135

Malicious code in bioql PyPI...

Cross-Site WebSocket Hijacking (CSWSH)

github.com/komari-monitor/komari is vulnerable to Cross-Site WebSocket Hijacking CSWSH. The vulnerability is due to disabled origin checking in the WebSocket upgrader, which allows an attacker to send malicious requests using a victim’s browser cookies and achieve remote code execution...

GO-2025-3874 Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari

Komari vulnerable to Cross-site WebSocket Hijacking in github.com/komari-monitor/komari...

GHSA-Q355-H244-969H Komari vulnerable to Cross-site WebSocket Hijacking

Summary WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated users Details https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.goL33-L35 Any third party website can send request...

Security Bulletin: IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities [CVE-2025-36116, CVE-2025-36117].

Summary IBM Db2 Mirror for i GUI is affected by cross-site WebSocket hijacking and session fixation vulnerabilities as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerabilities as described in the remediation/fixes section...

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

Summary Source code may be stolen when you access a malicious web site with non-Chromium based browser. Details The Origin header is checked to prevent Cross-site WebSocket hijacking from happening which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address Origin header...

CVE-2025-30360

The CVE-2025-30360 entry concerns webpack-dev-server prior to v5.2.1, where an Origin header check for WebSocket connections was insufficient, allowing IP-based origins to access the WebSocket and potentially exfiltrate source code to malicious sites using non-Chromium browsers. The issue is miti...