Open redirect

On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart...

CVE-2020-5931

On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart...

The vulnerability of the WebSockets API component of the CodeMeter license control application allows a perpetrator to gain unauthorized access to modify or create license files for CmActLicense.

The vulnerability of the WebSockets API of the CodeMeter license control application is related to a data source confirmation error. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to modify or create CmActLicense license files...

CodeMeter < 7.10a Multiple Vulnerabilities

According to its self-reported version, the CodeMeter WebAdmin server installed on the remote host is prior to 7.10a. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields. An...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

Design/Logic Flaw

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14519

CVE-2020-14519 affects CodeMeter WebAdmin’s internal WebSockets API. According to the provided documents, all versions prior to 7.00 are affected, including 7.0 or newer if the affected WebSockets API remains enabled, particularly when a web browser accesses the CodeMeter web server. The vulnerab...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

The vulnerability of the websockets.c component of the cross-platform library LibVNCServer allows a attacker to cause a service failure.

The vulnerability of the websockets.c component in the cross-platform library LibVNCServer is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failures...

DEBIAN-CVE-2020-15133

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not...

LibVNCServer Buffer Overflow Vulnerability (CNVD-2020-36778)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in a program. A buffer overflow vulnerability exists in the websockets.c file in versions of LibVNCServer prior to 9.12. The vulnerability stems from a web...

CVE-2017-18922

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...

Information Disclosure

apollo-server-hapi is vulnerable to information leakage. Lack of validation rules enforcement during the subscription server creation with NoInstrospection rule for websockets exposes GraphQL schema types, their relations, human-readable names and many More information on the references...

Information Leakage

apollo-server-lambda is vulnerable to information leakage. Lack of validation rules enforcement during the subscription server creation with NoInstrospection rule for websockets exposes GraphQL schema types, their relations, human-readable names and many More information on the references...

Quantopian: Ability to perform various POST requests on quantopian.com as a different user - insecure by design.

Summary: Due to excessive control of victim's UI over algorithm collaboration feature one is able to force algorithm collaborator to issue malicious POST requests. Description: Hello again my favorite VDP! WebSockets again. Following vulnerability can be abused to attack a person that we...

Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection

Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Date: 2020-03-30 Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link: http://www.grandstream.com/support/firmware/ucm62xx-official-firmware Version: 1.0.20.20 and below...

Protecting gRPC applications and APIs

Wallarm has always stood out from its competitors when it comes to supporting modern stacks. For a long time Wallarm has been the only product to provide comprehensive protection for WebSockets-based web applications. Once again, Wallarm is glad to be the pioneer and add support for the gRPC...

KLA11718 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Use after free...