6773 matches found
CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...
CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...
CVE-2025-41254
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...
EUVD-2025-34768
STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also affected...
Spring Framework 安全漏洞
Spring Framework is a Spring open source application development framework. A security vulnerability exists in Spring Framework versions 6.2.0 through 6.2.11, 6.1.0 through 6.1.23, 6.0.x through 6.0.29, and 5.3.0 through 5.3.45, which stems from a possible security bypass in a STOMP over WebSocke...
Cross-site Request Forgery (CSRF)
Overview org.springframework:spring-websocket is a framework that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF vi...
PT-2025-42473
Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.45 Spring Framework versions 6.0.x through 6.0.29 Spring Framework versions 6.1.0 through 6.1.23 Spring Framework versions 6.2.0 through 6.2.11 Description STOMP over WebSocket applications may allow...
CVE-2025-41705
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...
CVE-2025-41707
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
PT-2025-46947
Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11 Description Mattermost versions before 11 do not enforce multi-factor authentication on WebSocket connections. This allows unauthenticated users to access sensitive information through WebSocket events...
Astra Linux - уязвимость в tomcat9
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...
CVE-2025-41707
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
CVE-2025-41705
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...
CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
EUVD-2025-34147
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
CVE-2025-41707
The CVE-2025-41707 entry is associated with Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP and related QUINT4-series hardware. Multiple connected sources describe a denial-of-service vulnerability in the WebSocket handler that allows an unauthenticated remote attacker to trigger the issue by sending...
CVE-2025-41707 Phoenix Contact: WebSocket Handler Denial of Service
The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...
CVE-2025-41705
CVE-2025-41705 is reported as an unauthenticated MITM issue where an attacker can intercept websocket messages to obtain login credentials from the Webfrontend. Connected sources identify Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP as the affected device family, with the vulnerability described a...
CVE-2025-41705 Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...