130 matches found
Missing Authentication for Critical Function
Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the onwsconnect process. An attacker can gain unauthorized access to WebSocket subscription endpoints by connecting with the...
Everon å®å Øę¼ę“
Everon is an electric vehicle charging station system developed by Everon Corporation. There is a security vulnerability in Everonās system. This vulnerability stems from the lack of a limit on the number of authentication requests made through the WebSocket API, which can lead to denial-of-servi...
CVE-2026-25945
The CVE-2026-25945 issue concerns the WebSocket API, where there is no limit on authentication attempts. This vulnerability could allow an attacker to perform denial-of-service by suppressing or misrouting charger telemetry, or carry out brute-force attempts to gain unauthorized access. Connected...
CVE-2026-24731
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...
PT-2026-22217
Name of the Vulnerable Software and Affected Versions WebSocket Application Programming Interface affected versions not specified Description The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable an attacke...
PT-2026-3920
Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible and not actually offline because the response to a WebSocket API request includes the user in the presences array with "status": "offline", whereas offline users are omitted from the presences...
CVE-2022-31080
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is...
CVE-2025-13953 Bypass in the authentication method of the GTT Sistema de InformaciĆ³n Tributario application
Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory LDAP login method. Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data...
[SECURITY] Fedora 42 Update: qt5-qtwebsockets-5.15.18-1.fc42
The QtWebSockets module implements the WebSocket protocol as specified in RFC 6455. It solely depends on Qt no external dependencies...
[SECURITY] Fedora 42 Update: qt6-qtwebsockets-6.9.3-1.fc42
The QtWebSockets module implements the WebSocket protocol as specified in RFC 6455. It solely depends on Qt no external dependencies...
EUVD-2018-1101
Malware in sbrugna...
EUVD-2017-12063
Malware in sbrugna...
EUVD-2017-12062
Malware in sbrugna...
EUVD-2021-0968
Malware in sbrugna...
EUVD-2017-8903
Malware in sbrugna...
EUVD-2024-36338
Malicious code in bioql PyPI...
EUVD-2022-6265
Malicious code in bioql PyPI...
[SECURITY] Fedora 42 Update: qt6-qtwebsockets-6.9.1-1.fc42
The QtWebSockets module implements the WebSocket protocol as specified in RFC 6455. It solely depends on Qt no external dependencies...
CVE-2020-15391
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods on behalf of a victim because of a lack of authentication for the WebSocket protocol. This leads to remote code execution...
Azure Linux 3.0 Security Update: httpd (CVE-2024-36387)
The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36387 advisory. - Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference,...