67 matches found
CVE-2024-10037
A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection. An attacker must be properly authenticated and the test mode function of RTU500 must be enabled...
CVE-2024-10956: Origin Validation Error
GPT Academy version 3.83 in the binary-husky/gptacademic repository is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting...
Cybele Software Thinfinity Workspace security vulnerabilities
Cybele Software Thinfinity Workspace is an integrated solution for virtualizing applications, desktops, data and accessing any host from a unified portal from Cybele Software, USA. A security vulnerability exists in Cybele Software Thinfinity Workspace prior to v7.0.2.113 that stems from an acces...
Could not open websocket connection please try by login again /nsconfig/sshd_config.
After Upgrade to 13.1 53.17, the customer is not able to do several actions in the Netscaler, including generate the support bundle from the GUI or connect to the CLI through the GUI, error: Could not open websocket connection. Please try by login again...
CVE-2024-5820: Missing Authorization
An unprotected WebSocket connection in the latest version of stitionai/devika commit ecee79f allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any such malicious website to intercept all...
SSLVPN error "Websocket connection failed: Connection closed before receiving a handshake responser"
After VPN tunnel established to NetScaler gateway, user encounter access issue s to backend server with error message: "Websocket connection to 'ws:///ws/notification/site-msg/' failed: Connection closed before receiving a handshake responser"...
HTML5 external users are not able to launch applications via Netscaler Gateway, Workspace works.
Users connecting externally are not able to launch connections with the Light HTML5 browser access but are able to launch with the Workspace App. Error displayed: "Citrix Workspace app cannot connect to the server. Please check your network connection or contact your help desk for assistance."...
Fortinet Fortigate Existing websocket connection persists after deleting API admin (FG-IR-23-028)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-028 advisory. - An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute...
Fedora: Security Advisory for rubygem-actioncable (FEDORA-2023-7002afbbb8)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
user can get document content even after removed
Description Admin can add a member to his personal collection .But if admin removed that user from this collection then that user still can see realtime document update content. Proof of Concept 1. From admin account invite user-B as member role .\ \ 2. From admin account create a private...
TLS certificate validation error
In mellium.im/xmpp, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification...
Token Validation Bypass
parse-server is vulnerable to token validation bypass. Lack of checking deleted sessions after the websocket connection was established allows clients with invalid session tokens to still receive subscription object...
[SECURITY] Fedora 33 Update: rubygem-actioncable-6.0.3.3-1.fc33
Structure many real-time application concerns into channels over a single WebSocket connection...
CVE-2020-24548: Server-Side Request Forgery (SSRF)
Ericom Access Server 9.2.0 for AccessNow and Ericom Blaze allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Cannot connect to" error messages to inform the attacker about closed ports...
CVE-2020-16271
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection...
Input validation
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection...
Design/Logic Flaw
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection...
CVE-2020-16272
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection...
CVE-2020-16272
The CVE-2020-16272 entry concerns Kee Vault KeePassRPC prior to 1.12.0. The SRP-6a implementation lacks validation of a client-provided parameter, enabling remote attackers over a WebSocket (A=0) connection to read and modify data in the KeePass database. Multiple sources (NVD entry, Red Hat advi...
PT-2020-14859
Name of the Vulnerable Software and Affected Versions Kee Vault KeePassRPC versions prior to 1.12.0 Description The issue concerns the SRP-6a implementation, which generates insufficiently random numbers. This allows remote attackers to read and modify data in the KeePass database via a WebSocket...