Code injection

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. A WebRTC implementation shouldn't allow the user to continue if verificatio...

CVE-2021-28681

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. A WebRTC implementation shouldn't allow the user to continue if verificatio...

CVE-2021-28681

CVE-2021-28681 affects Pion WebRTC before 3.0.15. The vulnerability arises when a DTLS connection isn’t properly torn down after certificate verification fails; the PeerConnectionState is set to failed, but a user could continue to use the PeerConnection. Impact reported: data channel communicati...

Sean DuBois Pion WebRTC 安全漏洞

Sean DuBois Pion WebRTC is Sean DuBois an open source application . Pion WebRTC is a Go implementation of WebRTC. A security vulnerability exists in Pion WebRTC before 3.0.15, which stems from not properly closing DTLS connections...

Validation Bypass

github.com/pion/dtls is vulnerable to validation bypass . The function handleIncomingPacket is not validating the incoming application data with epoch 0, accepting a remote user provided unencrypted or unauthenticated data after handshake completion...

Pion DTLS Authorization Issues Vulnerability

Pion DTLS is a Go-based implementation of DTLS Packet Transport Layer Security Protocol. An authorization issue vulnerability exists in Pion DTLS versions prior to 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary unencrypted data after the handshake completes...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

Design/Logic Flaw

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

CVE-2019-20786

CVE-2019-20786 (Pion DTLS) : The vulnerability exists in handleIncomingPacket (conn.go) of Pion DTLS prior to 1.5.2, which does not check application data with epoch 0. This allows remote attackers to inject arbitrary unencrypted data after the DTLS handshake. Affected software: Pion DTLS (versio...

pion-decor.ru XSS vulnerability

Open Bug Bounty ID: OBB-224570 Description| Value ---|--- Affected Website:| pion-decor.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...