Improper exception handling in Aedes

An issue was discovered in MoscaJS Aedes 0.42.0 and fixed in 0.42.1. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

Incorrect Authorization

Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will...

GHSA-5HX7-77G4-WQX3 Incorrect Authorization

Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will...

Denial Of Service (DoS)

aedes is vulnerable to denial of service. A remote attacker is able to crash the server by sending a malicious payload containing a published header and message length as 0 due to improper error handling in writeNumberCached while trying to create a packet for Publish Release...

CVE-2020-13410

An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

CVE-2020-13410

An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

Design/Logic Flaw

An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

CVE-2020-13410

An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

CVE-2020-13410

The CVE-2020-13410 issue affects MoscaJS Aedes 0.42.0, where lib/write.js does not properly handle exceptions when writing an invalid packet to a stream. This detail appears consistently across multiple sources (Red Hat advisory, CVE records, and OSV/GHSA entries). The underlying cause is an impr...

PT-2020-13523 · Mosca · Moscajs Aedes

Name of the Vulnerable Software and Affected Versions: MoscaJS Aedes version 0.42.0 Description: An issue was discovered in the handling of exceptions during the writing of an invalid packet to a stream in lib/write.js. Recommendations: For version 0.42.0, update to version 0.42.1 to resolve the...

CVE-2020-13410: Improper Handling of Exceptional Conditions

An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream...

GHSA-4CMX-HRQ9-C23P Improper Authorization in aedes

Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will. Recommendation Update to version 0.35.1 or later...

Improper Authorization in aedes

Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will. Recommendation Update to version 0.35.1 or later...

@sematext/logagent (>=2.0.101, <=2.0.126), cashew-mqtt (>=0.0.6, <=0.1.20) +7 more potentially affected by CVE-2018-3778 via aedes (>=0.9.0, <=0.34.1)

aedes NPM version =0.9.0, =2.0.101, =0.0.6, =0.1.0, =0.0.1, =0.5.1, =1.0.2, =0.0.1, =0.5.1, =0.5.16 Source cves: CVE-2018-3778 Source advisory: OSV:GHSA-4CMX-HRQ9-C23P...

Privilege Escalation

aedes is susceptible to privilege escalation. The vulnerability is possible because the authorization of user is not validated to publish a LWT in a channel...

Authorization

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Improper authorization in aedes version 0.35.0 will publish a LWT in a channel when a client is not authorized...

CVE-2018-3778

Affected software: aedes (MQTT broker) prior to version 0.35.1. Root cause: improper authorization allows publishing a Last Will (LWT) in a channel when a client is not authorized. Impact: potential unauthorized LWT publication in a channel; explicit exploitation details are not provided in the d...