PT-2024-71: Predictable format of user identifiers in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism...

PT-2024-73: Unlimited session lifetime in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application does not limit the storage time of the session identifier or credentials, or this time is excessively long. An attacker can reuse old credentials or session identifiers to log in as another user and gain...

PT-2024-74: Incorrect session termination in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application incorrectly terminates the session and allows attacker to reuse session credentials to obtain user information. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 04.11.2024...

CVE-2024-50347

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

Insufficient Verification of Data Authenticity

Overview laravel/reverb is a provider of a real-time WebSocket communication backend for Laravel applications. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through the verification of API signatures. An attacker can manipulate the API by sendi...

GHSA-PFRR-XVRF-PXJX Laravel Reverb Missing API Signature Verification

Impact A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information such as number of...

Laravel Reverb Missing API Signature Verification

Impact A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information such as number of...

CVE-2024-50347 Laravel Reverb has Missing API Signature Verification

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

CVE-2024-50347

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

CVE-2024-50347 Laravel Reverb has Missing API Signature Verification

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

CVE-2024-50347

Laravel Reverb prior to 1.4.0 has a verification signature issue affecting the Pusher-compatible API endpoints (not the WebSocket connections). The vulnerability allows an attacker to submit requests with forged/unverified signatures, potentially influencing endpoints such as POST /events, GET /c...

CVE-2024-50347 Laravel Reverb has Missing API Signature Verification

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

PT-2024-34157 · Laravel · Laravel Reverb

Name of the Vulnerable Software and Affected Versions: Laravel Reverb versions prior to 1.4.0 Description: The issue is related to unverified verification signatures for requests sent to Reverb's Pusher-compatible API. This API is used for scenarios such as broadcasting messages or obtaining...

Laravel Reverb 数据伪造问题漏洞

Laravel Reverb is an open source library for The Laravel Framework. It brings real-time WebSocket communication to Laravel applications. A data forgery issue vulnerability exists in Laravel Reverb versions prior to 1.4.0, which stems from a failure to validate the authentication signature of...

CVE-2024-50347: Improper Verification of Cryptographic Signature

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

PT-2024-41024 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher affected versions not specified Description: The issue is related to incorrect session expiration limitation in the Password Pusher web service, which allows information to be transmitted via temporary links. This could enable...

PT-2024-41025

Name of the Vulnerable Software and Affected Versions Password Pusher affected versions not specified Description The issue is related to incorrect session management in the Password Pusher web service, which allows for the transmission of information via temporary links. This can be exploited by...

PT-2024-35447 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions prior to v1.49.0 Description: The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially...

PT-2024-37046 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions 1.50.3 and prior Description: A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session tok...

Authentication Bypass

pusher/pusher-php-server is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of the channel name and socket ID, which allows malicious end-users to forge access to unauthorized private channels...