93 matches found
CVE-2026-68554
A flaw was found in Coturn, a free open source implementation of TURN and STUN Session Traversal Utilities for NAT Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows...
DEBIAN-CVE-2026-65981
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...
EUVD-2026-51627
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...
DEBIAN-CVE-2026-53448
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not...
PT-2026-57251
Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.0 Description The psd print sessions dump CLI command accepts a filename argument that is passed to the fopen function without path validation. An authenticated administrator with CLI access can overwrite arbitrar...
DEBIAN-CVE-2026-43915
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting XSS vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that execut...
EUVD-2026-37939
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting XSS vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that execut...
EUVD-2026-25248
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi...
CVE-2026-31181
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi...
CVE-2026-31181
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi...
CVE-2026-31181
The ToToLink A3300R wireless router is vulnerable to an OS command injection flaw in the stunServerAddr parameter within the /cgi-bin/cstecgi.cgi file. The root cause is the failure to properly validate this parameter, which allows an attacker to execute arbitrary commands on the device. This iss...
CVE-2026-40613
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8t to uint16t without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, thi...
UBUNTU-CVE-2026-40613
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8t to uint16t without alignment checks. When processing a crafted STUN message with odd-aligned attribute boundaries, thi...
CVE-2026-27624
Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "::1" and "::", but IPv4-mapped IPv6 is not...
Coturn 安全漏洞
Coturn is an open-source implementation of TURN TURN VoIP Media Services NAT Traversal Server and Gateway and STUN Simple Transfer of User Datagram Protocol Network Address Translators Servers. Versions of Coturn prior to 4.9.0 contained security vulnerabilities; these vulnerabilities stemmed fro...
MiracleLinux 7 : firefox-68.10.0-1.0.1.el7.AXS7 (AXSA:2020-210:14)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-210:14 advisory. Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64 CVE-2020-12417 Mozilla: Information disclosure due to manipulated URL...
MiracleLinux 4 : firefox-68.10.0-1.0.1.AXS4 (AXSA:2020-213:15)
The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-213:15 advisory. Mozilla: Information disclosure due to manipulated URL object CVE-2020-12418 Mozilla: Use-after-free in nsGlobalWindowInner CVE-2020-12419 Mozilla:...
EUVD-2015-0847
Malware in sbrugna...