Instacart: User Information sent to client through websockets

I noticed when monitoring the websocket requests that the account information of user, including userid is sent to the client. "t":"d","d":"r":8,"a":"p","b":"p":"/carts/3671079xjdJHqx88J435eDW5zxN/users/-KRbGN8R6uIjy6OPxj","d":"id":25390626,"name":"Username...

KLA10876 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper value...

MITM BLE Security Assessment: gattacker

MITM BLE Security Assessment A Node.js package for BLE Bluetooth Low Energy Man-in-the-Middle & more The tool creates exact copy of attacked device in Bluetooth layer, and then tricks mobile application to interpret its broadcasts and connect to it instead the original device. At the same time, i...

Legal Robot: User Information sent to client through websockets

Hey, I noticed when monitoring the websocket requests that the account information of many users, including email address, is sent to the client. For example: ██████ ██████████ █████████ ████████ ███████ There's hundreds of these requests, each containing user information. Please let me know if...

The vulnerability of the Firefox browser, which allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the WebSocketChannel class in the Firefox WebSockets subsystem is caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or trigger a service failure memory corruption using specially crafted packets that cause incorrect...

DEBIAN-CVE-2016-5261

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR 45.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via crafted packets that trigger incorrect buffer-resize operations durin...

Integer overflow

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR 45.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via crafted packets that trigger incorrect buffer-resize operations durin...

CVE-2016-5261

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR 45.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via crafted packets that trigger incorrect buffer-resize operations durin...

firefox: multiple issues

CVE-2016-0718 arbitrary code execution Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 information disclosure Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 arbitrary code execution Mozilla developers and community members...

Integer overflow in WebSockets during data buffering — Mozilla

Security researcher Samuel Groß reported an integer overflow error in WebSockets during data buffering on incoming packets when an allocated buffer is resized incorrectly. This results in the buffer array holding the data being shrunk, instead of grown, resulting in attacker controlled data being...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to memory usage after it is freed, located in the net/websockets/websocketjob.cc component of the WebSockets framework. Exploiting this vulnerability allows a malicious actor to cause service failures or otherwise affect the system by...

openSUSE Security Update : Mozilla Firefox (openSUSE-2016-259)

This update for MozillaFirefox fixes the following issues : - update to Firefox 44.0.2 - MFSA 2016-13/CVE-2016-1949 bmo1245724, boo966438 Same-origin-policy violation using Service Workers with plugins - Fix issue which could lead to the removal of stored passwords under certain circumstances...

openSUSE Security Update : MozillaFirefox (openSUSE-2016-223)

This update for MozillaFirefox fixes the following issues : - update to Firefox 44.0.2 - MFSA 2016-13/CVE-2016-1949 bmo1245724, boo966438 Same-origin-policy violation using Service Workers with plugins - Fix issue which could lead to the removal of stored passwords under certain circumstances...

qemu: vnc: insufficient resource limiting in VNC websockets decoder

It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory...

SUSE: Security Advisory for qemu (SUSE-SU-2015:0896-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.3 Security Update : kvm (SAT Patch Number 10645)

This update for KVM fixes an issue in the virtio-blk driver which could result in incorrectly setting its WCE configuration. Under some circumstances, this misconfiguration could cause severe file system corruption, because cache flushes were not generated as they ought to have been. The update...

USN-2608-1 qemu, qemu-kvm vulnerabilities

Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as VENOM. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, wh...

USN-2608-1: QEMU vulnerabilities

Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as VENOM. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, wh...

Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2608-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2608-1 advisory. Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as VENOM. A malicious guest could use this issue to...

SUSE-SU-2015:0896-1 Security update for qemu

qemu / kvm was updated to fix a security issue and some bugs. Security issue fixed: CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host. CVE-2015-1779: Fixed insufficient resource...