Cross site request forgery (csrf)

A flaw was found in OpenShift. The existing Cross-Site Request Forgery CSRF protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF...

CVE-2024-1342

OpenShift CSRF flaw (CVE-2024-1342): protections do not properly cover GET requests, enabling creation of WebSockets via CSRF. Affected: Red Hat OpenShift. Root cause: CSRF protection weakness for GET traffic. Impact: potential unauthorized WebSocket creation; no exploit details provided in these...

CVE-2024-21849

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Code injection

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849 BIG-IP Websockets vulnerability

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849

CVE-2024-21849 affects BIG-IP with Advanced WAF/ASM configured and a Websockets profile on a virtual server. The underlying issue is that undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to a DoS condition. The vulnerability is documented as affecting B...

K000135873: BIG-IP Websockets vulnerability CVE-2024-21849

Security Advisory Description When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. CVE-2024-21849 Impact Traffic is disrupted while the TMM process restarts...

F5 Networks BIG-IP : BIG-IP Websockets vulnerability (K000135873)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K000135873 advisory. - When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed...

PT-2024-19091 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP affected versions not specified Description: When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to...

CVE-2024-1342

A flaw was found in OpenShift. The existing Cross-Site Request Forgery CSRF protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF...

CentOS 8 : thunderbird (CESA-2023:0463)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:0463 advisory. - Mozilla: libusrsctp library out of date CVE-2022-46871 - Mozilla: Fullscreen notification bypass CVE-2022-46877 - Mozilla: Arbitrary file read from G...

Npm Trojan Bypasses UAC, Installs AnyDesk with "Oscompatible" Package

A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines. The package, named "oscompatible," was published on January 9, 2024, attracting a total of 380 downloads before it was taken down. oscompatible included ...

This Week in Spring - January 16th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 16th of January already! We're closer to February than not! I can hardly believe it. As always, we've got a lot to cover so let's dive right into it. the Spring Authorization Server 1.3.0-m1 is now available this is...

Fedora 38 : unrealircd (2023-41f41fbb69)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-41f41fbb69 advisory. UnrealIRCd 6.1.4 This release fixes a crash issue with websockets in UnrealIRCd 6.1.0 - 6.1.3. The full advisory with all details is available at:...

CVE-2023-50784

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet if a websocket port is open. Remote code execution might be possible on some uncommon, older platforms...

CVE-2023-50784

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet if a websocket port is open. Remote code execution might be possible on some uncommon, older platforms...

Buffer overflow

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet if a websocket port is open. Remote code execution might be possible on some uncommon, older platforms...

CVE-2023-50784

UnrealIRCd 6.1.0–6.1.3 contains a buffer overflow in the websockets implementation that allows an unauthenticated remote attacker to crash the IRCd by sending an oversized packet on an open websocket port. Some older, less common platforms may also allow remote code execution. The issue is addres...

UnrealIRCd Security Vulnerability

UnrealIRCd is an open source IRC server from UnrealIRCd Open Source. A security vulnerability exists in UnrealIRCd versions 6.1.0 through 6.1.3, which stems from a buffer overflow vulnerability in websockets...