903 matches found
CVE-2024-37890
creationtimestamp| type| source ---|---|--- 2024-06-16 16:28:36+00:00| published-proof-of-concept| https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q...
OPENSUSE-SU-2024:11280-1 python36-websockets-9.1-2.1 on GA media
These are all security issues fixed in the python36-websockets-9.1-2.1 package on the GA media of openSUSE Tumbleweed...
Mattermost: Posts sent via websockets aren't sanitized properly
The posts sent via websockets in the Mattermost application were not properly sanitized, allowing attackers to inject malicious content. The vulnerability enabled the creation of customized permalink embeds and YouTube embeds with arbitrary content, which could lead to denial-of-service issues an...
Fedora: Security Advisory for python-aiohttp (FEDORA-2024-f83b123d63)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for python-aiohttp (FEDORA-2024-000a25f3fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Apache 2.4.x < 2.4.54 Multiple Vulnerabilities (mod_lua)
The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory. - Denial of service in modlua r:parsebody: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that...
Fedora: Security Advisory for libre (FEDORA-2024-a63e807450)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: libre-3.10.0-1.fc40
Libre is a generic library for real-time communications with async I/O support. Features are a SIP stack RFC 3261, SDP, RTP and RTCP, SRTP and SRTCP Secure RTP, DNS client, STUN/TURN/ICE stack, BFCP, HTTP stack with client/server, Websockets, Jitter buffer, async I/O poll, epoll, select, kqueue,...
CVE-2024-28179
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...
CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...
CVE-2024-28179
CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...
Jupyter Server Proxy's Websocket Proxying does not require authentication
Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...
PT-2024-2426 · Unknown · Jupyter Server Proxy
Name of the Vulnerable Software and Affected Versions: Jupyter Server Proxy versions prior to 3.2.3 Jupyter Server Proxy versions prior to 4.1.1 Description: The issue is related to the lack of proper user authentication when proxying websockets in Jupyter Server Proxy. This allows unauthenticate...
CVE-2024-28121
stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...
Design/Logic Flaw
stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...
CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex
stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...
CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex
stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...
CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex
stimulusreflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security...
CVE-2024-28121
CVE-2024-28121 affects StimulusReflex. A websocket payload targeting a reflex can trigger arbitrary method calls on the reflex instance, because the server locates the method and uses it (via public_send) without strict validation, risking unsafe methods (e.g., instance_variable_set, system). Thi...