Design/Logic Flaw

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server...

CVE-2020-26149

CVE-2020-26149 affects NATS client libraries in JavaScript/TypeScript ecosystems: nats.js, nats.ws, and nats.deno. The root cause is a information/credential disclosure flaw where sensitive credentials (including TLS client private keys in mutual TLS setups) can be leaked from the client to the s...

CVE-2020-26149

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server...

CVE-2020-5910

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System NATS messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized...

Authentication flaw

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System NATS messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized...

CVE-2020-5910

CVE-2020-5910 affects NGINX Controller’s NATS messaging service. Affected versions are 3.0.0–3.5.0, 2.0.0–2.9.0, and 1.0.1, where NATS does not require authentication, allowing any successful connection to be authorized. Impact described includes potential eavesdropping and unauthorized access to...

F5 NGINX Controller Authentication Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in the NGINX controller NATS messaging service in F5 NGINX Controller versions 1.0....

Dsiem - Security Event Correlation Engine For ELK Stack

Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, and...

Denial Of Service (DoS)

github.com/nats-io/nats-server is susceptible to denial of service DoS. It does not validate whether the maximum payload size exceeds the size of int32, allowing an attacker to crash the application by sending a request with malicious payload...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

Integer overflow

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

CVE-2019-13126

CVE-2019-13126 is an integer overflow in the NATS Server prior to 2.0.2 that allows a remote attacker to crash the server by sending a crafted request; if authentication is enabled, the attacker must have authenticated first. Public notices extend risk to later versions (e.g., GHSA references for...

CVE-2019-13126

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated...

PT-2019-13141 · Nats · Nats Server

Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.2.0 Description: The issue is caused by an integer overflow that allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, the attacker must first authenticate. Th...

Adventures in Video Conferencing Part 1: The Wild World of WebRTC

Posted by Natalie Silvanovich, Project Zero Over the past five years, video conferencing support in websites and applications has exploded. Facebook, WhatsApp, FaceTime and Signal are just a few of the many ways that users can make audio and video calls across networks. While a lot of research ha...

inescapablebondage.com XSS vulnerability

Vulnerable URL: http://inescapablebondage.com/?nats=%22%3E%3Cimg%20src=x%20onerror=prompt%27OPENBUGBOUNTY%27%3EMzAwMDA4My4xLjMuMy4xLjAuMC4wLjA Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

[SECURITY] Fedora 19 Update: miredo-1.2.5-4.fc19

Miredo is an implementation of the "Teredo: Tunneling IPv6 over UDP through NATs" proposed Internet standard RFC4380. It can serve either as a Teredo client, a stand-alone Teredo relay, or a Teredo server, please install the miredo-server or miredo-client appropriately. It is meant to provide IPv...