6858 matches found
CVE-2022-39386
The CVE concerns @fastify/websocket/fastify-websocket: all versions are reported to crash when processing a specific malformed WebSocket packet, causing a Denial of Service. The issue stems from a crash on malformed input, and the module is deprecated with no built-in patches. Patched versions ar...
fastify/websocket vulnerable to uncaught exception via crash on malformed packet
Impact Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. Patches This has been patched in v7.1.1 fastify v4 and v5.0.1 fastify v3. Workarounds No...
GHSA-4PCG-WR6C-H9CQ fastify/websocket vulnerable to uncaught exception via crash on malformed packet
Impact Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. Patches This has been patched in v7.1.1 fastify v4 and v5.0.1 fastify v3. Workarounds No...
@kyedoesdev/lente-cli (>=0.1.0, <=0.1.1), @kyedoesdev/lente-core (0.1.0) potentially affected by CVE-2022-39386 via @fastify/websocket (5.0.0)
@fastify/websocket NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/websocket and may be impacted: - @kyedoesdev/lente-cli =0.1.0, =0.1.1 - @kyedoesdev/lente-core 0.1.0 Source cves: CVE-2022-39386 Source advisory:...
@frontify/frontify-cli (5.0.1), @my-healthcare/kankan-services (1.0.0) +8 more potentially affected by CVE-2022-39386 via @fastify/websocket (6.0.1)
@fastify/websocket NPM version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/websocket and may be impacted: - @frontify/frontify-cli 5.0.1 - @my-healthcare/kankan-services 1.0.0 - @ts4/hc =1.0.19, =1.0.2, =1.0.66, =0.0.1, =0.6.0,...
@0x77/ccpack (>=0.0.0, <=0.1.5), @aio-server/core (>=0.0.1, <=0.0.1001) +27 more potentially affected by CVE-2022-39386 via fastify-websocket (>=4.0.0, <=4.2.2)
fastify-websocket NPM version =4.0.0, =0.0.0, =0.0.1, =0.0.1, =4.3.0-depup.0, =0.2.42, =2.0.3, =9.1.1, =1.8.0, =1.0.0-pre.3, =2.0.0-alpha, =1.0.0, =0.0.1, =1.0.1, =0.0.10, =0.0.40 and more Source cves: CVE-2022-39386 Source advisory: OSV:GHSA-4PCG-WR6C-H9CQ...
PT-2022-24945 · Fastify · @Fastify/Websocket
Name of the Vulnerable Software and Affected Versions: fastify-websocket versions prior to 7.1.1 fastify v4 and prior to 5.0.1 fastify v3 @fastify/websocket all versions, deprecated Description: Any application using @fastify/websocket could crash if a specific, malformed packet is sent. The issu...
.NET Core Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 5.0,...
GHSA-RH58-R7JH-XHX3 .NET Core Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 5.0,...
nodejs: DNS rebinding in --inspect via invalid IP addresses
A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided for instance, 10.0.2.555 is provided, browsers such as Firefox will make DNS requests ...
OESA-2022-1989 lighttpd security update
Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more...
Debian: Security Advisory (DLA-3133-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
pyFlipper - Unoffical Flipper Zero Cli Wrapper Written In Python
Unoffical Flipper Zero cli wrapper written in Python Functions and characteristics: Flipper serial CLI wrapper Websocket client interface Setup instructions: $ git clone https://github.com/wh00hw/pyFlipper.git $ cd pyFlipper $ python3 -m venv venv $ source venv/bin/activate $ pip install -r...
PT-2022-25553 · Zammad · Zammad
Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.1 Description: The issue concerns Incorrect Access Control in Zammad's asset handling mechanism. This mechanism is designed to prevent customer users from accessing personal information of other users. However, the logic wa...
Apache Pulsar Broker, Proxy, and WebSocket Proxy vulnerable to Improper Certificate Validation
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...
CVE-2022-33682
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...
Design/Logic Flaw
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Vmware Tanzu Spring Framework (CVE-2022-22971)
Summary IBM Sterling Partner Engagement Manager uses Vmware Tanzu Spring Framework that is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework ...
nodejs: DNS rebinding in --inspect via invalid IP addresses
A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided for instance, 10.0.2.555 is provided, browsers such as Firefox will make DNS requests ...
