6198 matches found
gdbgui - A browser-based frontend/gui for GDB
A modern, browser-based frontend to gdb gnu debugger. Add breakpoints, view stack traces, and more in C, C++, Go, and Rust! Simply run gdbgui from the terminal and a new tab will open in your browser. Install sudo pip install gdbgui --upgrade Since gdbgui is under active development, consider...
CVE-2017-5621
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API...
CVE-2017-5621
An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article, when using either the REST API or the WebSocket API...
CVE-2017-5621
CVE-2017-5621 affects Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. The issue is a cross-site scripting (XSS) vulnerability triggered by malicious HTML in chat messages or ticket article content when using REST or WebSocket APIs. The vulnerability allows an attacker to inject s...
PostMessage cross-domain vulnerability-vulnerability warning-the black bar safety net
Note: this article is“millet Security Center”original, reprint please contact the“millet Security Center” Background Value: $3000 Vulnerability cause: postMessage cross-domain vulnerabilities to cause, the use of the websocket receives a user authentication token Original address:...
Legal Robot: Cross Site WebSocket Hijacking
Description: The given URL fails to validate Origin header- leading to Cross-Site WebSocket Hijacking. Impact: The impact, however, depends on how the server is configured. For example, it might require an authentication token which are user specific. In such cases, it might not be as sever as it...
Uber: [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.
Vulnerability description not provided...
geoip-attack-map - Cyber Security GeoIP Attack Map Visualization
This geoip attack map visualizer was developed to display network attacks on your organization in real time. The data server follows a syslog file, and parses out source IP, destination IP, source port, and destination port. Protocols are determined via common ports, and the visualizations vary i...
FreeBSD : node.js -- multiple vulnerabilities (27180c99-9b5c-11e6-b799-19bef72f4b7c)
Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x : Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSLCONF environment variable or from the default location for the current platform. Always triggering a...
Legal Robot: The websocket traffic is not secure enough
'Cross-Site WebSocket Hijacking' is possible, because the websocket connection is not secure enough. The traffic from and to the websocket can be sniffed with Chrome see attachment, and replayed elsewhere cross-domain. Explanation:...
node.js -- multiple vulnerabilities
Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x: Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSLCONF environment variable or from the default location for the current platform. Always triggering a...
Denial of Service
Overview Affected versions of uws do not properly handle large websocket messages when permessage-deflate is enabled, which may result in a denial of service condition. If uws recieves a 256Mb websocket message when permessage-deflate is enabled, the server will compress the message prior to...
[SECURITY] Fedora 25 Update: rubygem-actioncable-5.0.0.1-1.fc25
Structure many real-time application concerns into channels over a single WebSocket connection...
The vulnerability of the Firefox browser, which allows a hacker to trigger a service failure or execute arbitrary code.
The vulnerability of the WebSocketChannel class in the Firefox WebSockets subsystem is caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or trigger a service failure memory corruption using specially crafted packets that cause incorrect...
[SECURITY] Fedora 24 Update: python-autobahn-0.10.9-1.gitcf10233.fc24
Autobahn a networking library that is part of the Autobahn project and prov ides implementations of The WebSocket Protocol http://tools.ietf.org/html/rfc6455 The Web Application Messaging Protocol WAMP http://wamp.ws for Twisted and asyncio on Python 2 & 3 and for writing servers and clients...
UBUNTU-CVE-2016-5261
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR 45.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via crafted packets that trigger incorrect buffer-resize operations durin...
KLA10852 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code, spoof user interface, bypass security restrictions, conduct cross-site scripting or read local...
UBUNTU-CVE-2016-5137
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...
Autobahn|Python Origin Header Manipulation
Observation: Autobahn|Python incorrectly checks the Origin header when the 'allowedOrigins' value is set. This can allow third parties to execute legitimate requests for WAMP WebSocket requests against an Autobahn|Python/Crossbar.io server within another browser's context. Proof of Concept: The...