io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

io.undertow:undertow-http2-test-suite (1.3.1.final), io.undertow:undertow-servlet (1.3.1.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.1.final)

io.undertow:undertow-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.1.final - io.undertow:undertow-servlet 1.3.1.final -...

com.fizzed:ninja-undertow (>=5.3.1.undertow1, <=5.3.1.undertow2), io.undertow:undertow-http2-test-suite (1.3.17.final) +4 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.17.final)

io.undertow:undertow-core MAVEN version 1.3.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.fizzed:ninja-undertow =5.3.1.undertow1, =1.1.7, =2.0.0-beta-2 -...

io.undertow:undertow-servlet (1.3.26.final), io.undertow:undertow-websockets-jsr (1.3.26.final) +9 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.26.final)

io.undertow:undertow-core MAVEN version 1.3.26.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.26.final - io.undertow:undertow-websockets-jsr 1.3.26.final -...

io.undertow:undertow-servlet (1.3.29.final), io.undertow:undertow-websockets-jsr (1.3.29.final) potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.29.final)

io.undertow:undertow-core MAVEN version 1.3.29.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.29.final - io.undertow:undertow-websockets-jsr 1.3.29.final Source...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

com.datathings:greycat-websocket (9), io.undertow:undertow-servlet (1.4.17.final) +1 more potentially affected by CVE-2020-27782 via io.undertow:undertow-core (1.4.17.final)

io.undertow:undertow-core MAVEN version 1.4.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.datathings:greycat-websocket 9 - io.undertow:undertow-servlet 1.4.17.final -...

[SECURITY] [DSA 5047-1] prosody security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5047-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 15, 2022 https://www.debian.org/security/faq -...

CVE-2022-21667

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...

Design/Logic Flaw

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...

CVE-2022-21667 Denial of Service in soketi

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...

CVE-2022-21667 Denial of Service in soketi

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...

CVE-2022-21667

The vulnerability CVE-2022-21667 affects soketi, an open‑source WebSockets server. An unhandled case when reading POST requests with an empty body can crash the server, even for unauthenticated clients using the Pusher Protocol. All users are affected; there are no workarounds and upgrading is re...

New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability

Cybersecurity researchers have discovered an entirely new attack vector that enables adversaries to exploit the Log4Shell vulnerability on servers locally by using a JavaScript WebSocket connection. "This newly-discovered attack vector means that anyone with a vulnerable Log4j version on their...

Brand-New Log4Shell Attack Vector Threatens Local Hosts

Defenders will once again be busy beavers this weekend: There’s an alternative attack vector for the ubiquitous Log4j vulnerability, which relies on a basic Javascript WebSocket connection to trigger remote code-execution RCE on servers locally, via drive-by compromise. In other words, an exploit...

Not with a Bang but a Whisper: The Shift to Stealthy C2

As defensive tools have evolved to detect more and more traditional attack techniques, it should come as no surprise that attackers have shifted tactics. This ever-evolving arms race between offensive security toolsets, bespoke advanced persistent threat APT malware and the billion-dollar infosec...

STEWS - A Security Tool For Enumerating WebSockets

STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains Fingerprint : determine what WebSockets server is running ...

Mozilla Firefox Security Advisory (MFSA2015-132) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Mozilla Firefox Security Advisory (MFSA2016-75) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

openSUSE: Security Advisory for civetweb (openSUSE-SU-2021:1424-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...