164 matches found
Security update for pgadmin4
This update for pgadmin4 fixes the following issues: CVE-2024-38355: Fixed socket.io: unhandled 'error' event bsc1226967 CVE-2024-38998: Fixed requirejs: prototype pollution via function config bsc1227248 CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts..configure...
SUSE CVE-2024-38355
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in...
Malicious code in socket.io-client-v2 (npm)
--- -= Per source details. Do not edit below this line.=-...
GHSA-25HC-QCG6-38WJ socket.io has an unhandled 'error' event
Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. node:events:502 throw err; // Unhandled 'error' event ^ Error ERRUNHANDLEDERROR: Unhandled error. undefined at new NodeError node:internal/errors:405:5 at...
PT-2023-31363 · Unknown · Uptime Kuma
Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.9 Description: Uptime Kuma is a self-hosted monitoring tool that uses WebSocket with Socket.io. Prior to version 1.23.9, the application does not verify the source of communication, allowing third-party...
PT-2023-22800 · Nodebb · Nodebb
Name of the Vulnerable Software and Affected Versions: NodeBB versions = 2.8.10 Description: The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages...
UBUNTU-CVE-2023-32695
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...
PT-2023-23969
Content removed...
NodeBB 安全漏洞
NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A security vulnerability exists in NodeBB versions prior to 2.6.1, which stems from the use of plain objects with prototypes in socket.io messag...
CVE-2022-2421
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object...
PT-2022-16539
Name of the Vulnerable Software and Affected Versions Socket.io versions prior to 4.5.2 Socket.io-client versions prior to 4.5.0 Socket.io-parser versions prior to 4.2.1 Socket.io-parser versions prior to 4.0.5 Socket.io-parser versions prior to 3.4.2 Socket.io-parser versions prior to 3.3.3...
Denial Of Service
Socket IO Client is vulnerable to denial of service. The vulnerability exists due to a null pointer dereference occurs when parsing invalid payload format which allows an attacker to cause an application crash...
GHSA-85XX-XHJM-RHRW Socket.IO-client Java before 2.0.1 vulnerable to NULL Pointer Dereference
The package io.socket:socket.io-client before 2.0.1 is vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format...
CVE-2022-25867
The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format...
Socket.IO-client Java 代码问题漏洞
Socket.IO-client Java is a full-featured Socket.IO client library for Java from the Socket.IO open source. Socket.IO-client Java versions prior to 2.0.1 security vulnerability , the vulnerability stems from the presence of NULL pointer duplicate references when parsing packets with an invalid...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Remediation Upgrade io.socket:socket.io-client to version 2.0.1 or higher. References - GitHub Commit - GitHub Commit - GitHub Issue - GitHub Release Credi...
kernel: use-after-free in function hci_sock_bound_ioctl()
A flaw use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...
CVE-2022-21676 Uncaught Exception in engine.io
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io...
AZL-45030 CVE-2020-36049 affecting package js-jquery 3.5.0-4
socket.io-parser before 3.4.1 allows attackers to cause a denial of service memory consumption via a large packet because a concatenation approach is used...