Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

Mattermost does not strip embeds from metadata when broadcasting posted events. This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

CVE-2024-21550

The CVE-2024-21550 entry concerns SteVe, an open platform implementing OCPP for EV charging points. Affected component: SteVe management interface accessed over WebSockets. Root cause: attackers can inject arbitrary HTML/JavaScript via WebSockets, resulting in persistent Cross‑Site Scripting. Imp...

CVE-2024-21550: Improper Neutralization of Input During Web Page Generation

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

PT-2024-18962 · Steve · Steve

Name of the Vulnerable Software and Affected Versions: SteVe affected versions not specified Description: SteVe is an open platform that implements different versions of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points...

How to Enable HTML5 Connections to Provisioning Services Based Catalogs

Enabling connections from Receiver for HTML5 to desktops deployed using Provisioning Services. Background Enabling connections from Receiver for HTML5 to desktops in Provisioning Services PVS based catalogs might require additional steps to complete depending on the persistence of the write cache...

OPENSUSE-SU-2024:14166-1 python310-websockets-12.0-2.6 on GA media

These are all security issues fixed in the python310-websockets-12.0-2.6 package on the GA media of openSUSE Tumbleweed...

GO-2024-2448 Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server

Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2024-37890

creationtimestamp| type| source ---|---|--- 2024-06-16 16:28:36+00:00| published-proof-of-concept| https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q 2026-09-14 03:00:15+00:00| seen| Telegram/D3eLZVc7h2lGu52Jh8ruDiE9lwCScvdIOQI0bH64z2-tgu8 2026-09-15 00:00:21+00:00|...

OPENSUSE-SU-2024:11280-1 python36-websockets-9.1-2.1 on GA media

These are all security issues fixed in the python36-websockets-9.1-2.1 package on the GA media of openSUSE Tumbleweed...

Mattermost: Posts sent via websockets aren't sanitized properly

The posts sent via websockets in the Mattermost application were not properly sanitized, allowing attackers to inject malicious content. The vulnerability enabled the creation of customized permalink embeds and YouTube embeds with arbitrary content, which could lead to denial-of-service issues an...

Fedora: Security Advisory for python-aiohttp (FEDORA-2024-f83b123d63)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for python-aiohttp (FEDORA-2024-000a25f3fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache 2.4.x < 2.4.54 Multiple Vulnerabilities (mod_lua)

The version of Apache httpd installed on the remote host is prior to 2.4.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.54 advisory. - Denial of service in modlua r:parsebody: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that...

Fedora: Security Advisory for libre (FEDORA-2024-a63e807450)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: libre-3.10.0-1.fc40

Libre is a generic library for real-time communications with async I/O support. Features are a SIP stack RFC 3261, SDP, RTP and RTCP, SRTP and SRTCP Secure RTP, DNS client, STUN/TURN/ICE stack, BFCP, HTTP stack with client/server, Websockets, Jitter buffer, async I/O poll, epoll, select, kqueue,...

CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...