whitelist-bypass

Whitelist Bypass Tunnels internet traffic through video calling platforms VK Call, Yandex Telemost, WB Stream to bypass government whitelist censorship. Setup Step-by-step setup guide in Russian: docs/SETUP.md How it works Two tunnel modes are available: DC DataChannel and Video VP8 data encoding...

CVE-2026-55663

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663

mediasoup , a WebRTC video conferencing system, contains a flaw in its built-in SCTP stack where state cookies are authenticated using only hardcoded magic values (msworker and 0xAD81) instead of a per-instance secret with HMAC, violating RFC 9260 §5.1.3. An on-path attacker targeting PlainTransp...

CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

PT-2026-81477

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663: Insufficient Verification of Data Authenticity

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

EUVD-2018-0289

Malware in sbrugna...

Directory Traversal in datachannel-client

Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

GHSA-JPG7-6C9F-7Q54 Directory Traversal in datachannel-client

Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

datachannel-client path traversal vulnerability

datachannel-client is a signaling implementation based on Node.js and Socket.io. A path traversal vulnerability exists in datachannel-client. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

Directory Traversal

datachannel-client is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

CVE-2017-16121

datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16121

datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16121

datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16121

The vulnerability CVE-2017-16121 affects the datachannel-client signaling implementation (Node.js/Socket.io) and enables directory traversal by using sequences like ../ in the request URL to access the filesystem. Multiple connected sources describe the issue as a path traversal that allows viewi...

CVE-2017-16121: Improper Limitation of a Pathname to a Restricted Directory

datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability(CVE-2016-8027)

Summary An exploitable blind sql injection vulnerability exists within McAfee's ePolicy Orchestrator 5.3.0 that is accessible without authentication. A specially crafted HTTP post can allow an aggressor to alter a sql query which can result in disclosure of information within the database or...

Directory Traversal

Overview Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerabl...