PT-2023-31363 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.9 Description: Uptime Kuma is a self-hosted monitoring tool that uses WebSocket with Socket.io. Prior to version 1.23.9, the application does not verify the source of communication, allowing third-party...

PT-2023-22800 · Nodebb · Nodebb

Name of the Vulnerable Software and Affected Versions: NodeBB versions = 2.8.10 Description: The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking eventName.startsWith or eventName.toString, while processing Socket.IO messages via crafted Socket.IO messages...

UBUNTU-CVE-2023-32695

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...

PT-2023-23969

Content removed...

NodeBB 安全漏洞

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A security vulnerability exists in NodeBB versions prior to 2.6.1, which stems from the use of plain objects with prototypes in socket.io messag...

CVE-2022-2421

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object...

PT-2022-16539

Name of the Vulnerable Software and Affected Versions Socket.io versions prior to 4.5.2 Socket.io-client versions prior to 4.5.0 Socket.io-parser versions prior to 4.2.1 Socket.io-parser versions prior to 4.0.5 Socket.io-parser versions prior to 3.4.2 Socket.io-parser versions prior to 3.3.3...

Denial Of Service

Socket IO Client is vulnerable to denial of service. The vulnerability exists due to a null pointer dereference occurs when parsing invalid payload format which allows an attacker to cause an application crash...

GHSA-85XX-XHJM-RHRW Socket.IO-client Java before 2.0.1 vulnerable to NULL Pointer Dereference

The package io.socket:socket.io-client before 2.0.1 is vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format...

CVE-2022-25867

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format...

Socket.IO-client Java 代码问题漏洞

Socket.IO-client Java is a full-featured Socket.IO client library for Java from the Socket.IO open source. Socket.IO-client Java versions prior to 2.0.1 security vulnerability , the vulnerability stems from the presence of NULL pointer duplicate references when parsing packets with an invalid...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Remediation Upgrade io.socket:socket.io-client to version 2.0.1 or higher. References - GitHub Commit - GitHub Commit - GitHub Issue - GitHub Release Credi...

kernel: use-after-free in function hci_sock_bound_ioctl()

A flaw use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

CVE-2022-21676 Uncaught Exception in engine.io

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io...

AZL-45030 CVE-2020-36049 affecting package js-jquery 3.5.0-4

socket.io-parser before 3.4.1 allows attackers to cause a denial of service memory consumption via a large packet because a concatenation approach is used...

CVE-2020-36049

socket.io-parser before 3.4.1 allows attackers to cause a denial of service memory consumption via a large packet because a concatenation approach is used...

Socketio Engineio Resource Management Error Vulnerability

Socketio Engineio is a Javascript-based real-time engine for bi-directional communication between browsers and devices from the Socketio community. A security vulnerability exists in Socketio Engine.IO before 4.0.0, which can be exploited by an attacker to cause a denial of service resource...

Insecure Defaults

Overview socket.io is a node.js realtime framework server. Affected versions of this package are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Remediation Upgrade socket.io to version 2.4.0 or higher. References - GitHub Issue - HackerOne...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

NodeBB Elevation of Privilege Vulnerability

NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A security vulnerability exists in the authentication logic in NodeBB versions 1.12.2 and later fixed in version 1.14.3. An attacker can exploit th...