6379 matches found
CVE-2024-26135 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...
CVE-2024-26135 MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking CSWSH vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is...
MeshCentral Security Vulnerability
MeshCentral is a complete web-based remote monitoring and management site for the MeshCentral community. A security vulnerability exists in MeshCentral versions prior to 1.1.21 that stems from the presence of a cross-site websocket hijacking vulnerability...
PT-2024-1961 · Ansible · Ansible Automation Platform
Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform affected versions not specified Description: A flaw in the Ansible automation platform was found, related to an insecure WebSocket connection used during installation from the Ansible rulebook EDA server. This issu...
Fixed in Apache Tomcat 10.1.19
Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 0052b374. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...
Fixed in Apache Tomcat 11.0.0-M17
Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit b0e3b1bd. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...
Fixed in Apache Tomcat 9.0.86
Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 52d6650e. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...
F5 BIG-IP Security Vulnerabilities
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in F5 BIG-IP that stems from undisclosed traffic that could cause the Traffic Management Microkernel TMM proce...
jenkins: cross-site WebSocket hijacking
A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...
Important: Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
jenkins: cross-site WebSocket hijacking
A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...
Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
jenkins: cross-site WebSocket hijacking
A flaw was found in Jenkins where websocket access to the CLI does not perform origin validation of requests when they are made through the websocket endpoint...
[SECURITY] Fedora 38 Update: python-aiohttp-3.9.3-1.fc38
Python HTTP client/server for asyncio which supports both the client and the server side of the HTTP protocol, client and server websocket, and webservers with middlewares and pluggable routing...
[SECURITY] Fedora 39 Update: python-aiohttp-3.9.3-1.fc39
Python HTTP client/server for asyncio which supports both the client and the server side of the HTTP protocol, client and server websocket, and webservers with middlewares and pluggable routing...
The vulnerability of the WebSocket component in the Nozomi Guardian network detection and monitoring tool, as well as the Nozomi Central Management Console (CMC) – a centralized security management tool – allows attackers to influence the confidentiality of the protected information.
The vulnerability of the WebSocket component in the Nozomi Guardian network detection and monitoring tool, as well as the Nozomi Central Management Console CMC, relates to the lack of authentication for critical functions. Exploiting this vulnerability could allow an attacker to influence the...
Cross-Site WebSocket Hijacking (CSWSH)
jenkins-core is vulnerable to Cross-Site Scripting. The vulnerability is due to improper origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking CSWSH vulnerability, allowing attackers to execute CLI commands on the Jenkins controller...
