io.undertow:undertow-servlet (1.0.0.alpha6), io.undertow:undertow-websockets-jsr (1.0.0.alpha6) potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.0.0.alpha6)

io.undertow:undertow-core MAVEN version 1.0.0.alpha6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha6 - io.undertow:undertow-websockets-jsr 1.0.0.alpha6 Source...

io.undertow:undertow-servlet (1.0.0.beta8), io.undertow:undertow-websockets-jsr (1.0.0.beta8) potentially affected by CVE-2019-3888 via io.undertow:undertow-core (1.0.0.beta8)

io.undertow:undertow-core MAVEN version 1.0.0.beta8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta8 - io.undertow:undertow-websockets-jsr 1.0.0.beta8 Source cves:...

Fedora Update for rubygem-actioncable FEDORA-2019-1cfe24db5c

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

Firefox, Firefox ESR and Thunderbird are vulnerable to denial of service attacks. A remote unauthenticated attacker could exploit the vulnerable WebSocket component when the object holding the connection is freed before the disconnection operation is finished in WebSockets resulting in applicatio...

Denial Of Service (DoS)

firefox is vulnerable to Integer overflow vulnerability. WebSocketChannel class in the WebSockets subsystem leads to an integer overflow which results in a denial-of-service condition. Remote attackers can execute arbitrary code via crafted packets that trigger incorrect buffer-resize operations...

Coda: Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)

Summary @fisher discovered a CSRF-related vulnerability in Coda docs by which an attacked could craft a convincing page that would make modifications to a specific document without the victim knowing. This is due to the inherent nature of Websockets not being secure by default. Although a...

Fedora 28 : mosquitto (2019-8cbe2a05cd)

Fixes for the following CVES : - CVE-2018-12546 - CVE-2018-12550 - CVE-2018-12551 The list of other fixes addressed in version 1.5.6 is: Broker : - Fixed comment handling for config options that have optional arguments. - Improved documentation around bridge topic remapping. - Handle mismatched...

Fedora 28 : python-websockets (2018-4dd851152c)

Security fix for CVE-2018-1000518 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Royal TS/X - Information Disclosure

RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output = document.getElementById"output"; testWebSocket; function testWebSocket writeToScreen"Let's retrieve some data..."; websocket = new WebSocketwsUri; websocket.onopen = functionevt...

Royal TSX Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: Royal TS/X - Information Disclosure Author: Jakub Palaczynski CVE: CVE-2018-18865 Affected product: ============= Royal TS/X RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output =...

Royal TS/X Information Disclosure

Title: Royal TS/X - Information Disclosure Author: Jakub Palaczynski Date: 10. July 2018 CVE: CVE-2018-18865 Affected product: ============= Royal TS/X RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output = document.getElementById"output"; testWebSocket; functio...

webkitgtk: WebSockets don't use system proxy settings

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by...

websockets is vulnerable to denial of service by memory exhaustion

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...

discord-py-unofficial (>=0.17.0b4, <=0.17.0b5), missinglinkai-resource-manager-docker (>=1.3.457, <=2.1.914) +6 more potentially affected by CVE-2018-1000518 via websockets (4.0.1)

websockets PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - discord-py-unofficial =0.17.0b4, =1.3.457, =0.2.0a28, =0.0.4, =0.1.0a12, =0.1.0a13 - web3 4.3.0 Source cves: CVE-2018-1000518 Source advisor...

discord-py-unofficial (>=0.17.0b4, <=0.17.0b5), missinglinkai-resource-manager-docker (>=1.3.457, <=2.1.914) +6 more potentially affected by CVE-2018-1000518 via websockets (4.0.1)

websockets PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - discord-py-unofficial =0.17.0b4, =1.3.457, =0.2.0a28, =0.0.4, =0.1.0a12, =0.1.0a13 - web3 4.3.0 Source cves: CVE-2018-1000518 Source advisor...

GHSA-6G87-FF9Q-V847 websockets is vulnerable to denial of service by memory exhaustion

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...

Fast TCP tunnel over HTTP: chisel

Chisel is a fast TCP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go Golang. Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Chisel is very similar t...

Grammarly: `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension

Summary 1. Attacker could trigger Grammarly extension's socket command using a crafted page to perform WS connectionand data sending from extension's background page with cookies and origin to any URL. 2. Additionally, commands received from the attacker's server are handled by extension and coul...

PT-2018-3985

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68 Description The issue is related to shortcomings in the authorization procedure of the Firefox web browser. It may allow a remote attacker to compromise data integrity. When a user visits a site marked as unsafe by...

Fedora Update for python-websockets FEDORA-2018-4dd851152c

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...