CVE-2022-25512: Exposure of Sensitive Information to an Unauthorized Actor

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys...

PT-2022-17342

Name of the Vulnerable Software and Affected Versions FreeTAKServer-UI version 1.9.8 Description The issue concerns the leakage of sensitive API and Websocket keys in FreeTAKServer-UI. Recommendations For FreeTAKServer-UI version 1.9.8, consider restricting access to sensitive API and Websocket...

OESA-2022-1553 rubygem-websocket-extensions security update

Generic extension manager for WebSocket connections. Security Fixes: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content ...

Fixed in Apache Tomcat 8.5.76

Important: Request mix-up CVE-2022-25762 If a web application sends a WebSocket message concurrently with the WebSocket connection closing, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a...

The vulnerability of the WebSockets API component of the CodeMeter license control application allows a perpetrator to execute arbitrary code.

The vulnerability of wibu codemeter software lies in the use of cryptographic algorithms that contain defects. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

Code injection

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701

PreMiD 2.2.0 contains a vulnerability where the websocket transport can be abused to receive events from a socket and emit events to a socket, enabling unintended access and potentially interfering with the victim’s Discord Now Playing status. Affected component: PreMiD’s websocket handling. Root...

PT-2022-12904

Name of the Vulnerable Software and Affected Versions PreMiD version 2.2.0 Description The issue allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

CVE-2021-46701: Origin Validation Error

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket, potentially interfering with a victim's "now playing" status on Discord...

Metasploit Weekly Wrap-Up

Nagios XI web shell upload module New this week is a Nagios Web Shell Upload module from Rapid7' own Jake Baines, which exploits CVE-2021-37343. This module builds upon the existing Nagios XI scanner written by Erik Wynter. Versions of Nagios XI prior to 5.8.5 are vulnerable to a path traversal...

GHSA-H289-X5WC-XCV8 Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

Impact If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in XEP-0156: Discovering Alternative XMPP Connection Methods the ServerName field...

Mellium has unspecified vulnerabilities

Mellium is a feature that provides functionality from the Extensible Messaging and Presence Protocol. Mellium suffers from a security vulnerability that could be exploited by an attacker to redirect WebSocket connection requests to a server under their control without causing TLS certificate...

Duplicate Advisory: TLS certificate validation error in mellium.im/xmpp

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h289-x5wc-xcv8. This link is maintained to preserve external references. Original Description In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket...

TLS certificate validation error

In mellium.im/xmpp, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification...

CVE-2022-24968

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification...