427 matches found
Socketio Engine.IO Denial of Service Vulnerability
Engine.IO is a transport-based implementation of Socket.IO's cross-browser/cross-device bi-directional communication layer.A denial-of-service vulnerability exists in versions of Socketio Engine.IO prior to 3.6.1, 4.0.0 and later, and prior to 6.2.1, which stems from a failure to properly handle...
be.ordina:microservices-dashboard-server (1.0.1), com.alexecollins.docker:docker-java-orchestration-core (>=2.11.17, <=2.11.18) +290 more potentially affected by CVE-2016-4970 via io.netty:netty-handler (>=4.1.0.beta1, <=4.1.0.final)
io.netty:netty-handler MAVEN version =4.1.0.beta1, =2.11.17, =2.11.15, =2.2.7, =1.7.9, =0.8.0, =3.0.0-rc1, =1.0.0-rc1, =1.3-release, =1.6-release and more Source cves: CVE-2016-4970 Source advisory: OSV:GHSA-RV63-GQM8-9W8Q...
org.atmosphere.nettosphere.samples:nettosphere-chat (2.3.1), org.atmosphere.nettosphere.samples:nettosphere-games (2.3.1) +5 more potentially affected by CVE-2021-21290 +1 more via io.netty:netty (3.10.2.final)
io.netty:netty MAVEN version 3.10.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - org.atmosphere.nettosphere.samples:nettosphere-chat 2.3.1 - org.atmosphere.nettosphere.samples:nettosphere-games 2.3.1 -...
Socketio Socket.io Access Control Error Vulnerability
Socketio Socket.io is a Javascript-based server-side application from the Socketio community that supports event-based bidirectional communication. A security vulnerability exists in socket.io before 2.4.0, which stems from a CORS misconfiguration and is prone to insecure default values...
Socketio Engineio Resource Management Error Vulnerability
Socketio Engineio is a Javascript-based real-time engine for bi-directional communication between browsers and devices from the Socketio community. A security vulnerability exists in socketio socket.io-parser before 3.4.1, which can be exploited by attackers to cause a denial of service memory...
GHSA-XQ8R-R72R-PQWM Downloads Resources over HTTP in roslib-socketio
Affected versions of roslib-socketio insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on th...
Downloads Resources over HTTP in roslib-socketio
Affected versions of roslib-socketio insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on th...
CVE-2020-24928
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
CVE-2020-24928
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
Design/Logic Flaw
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
CVE-2020-24928
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
CVE-2020-24928
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
CVE-2020-24928: Missing Authorization
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
PT-2020-15860
Name of the Vulnerable Software and Affected Versions PreMiD versions through 2.1.3 Description The issue concerns a locally hosted socketio web server in PreMiD, which is open to all origins on port 3020. This allows attackers to obtain sensitive Discord user information. Recommendations For...
aioambient (>=0.1.1, <=0.1.3), eaxum-zou (>=0.0.1, <=0.0.15) +4 more potentially affected by CVE-2019-13611 via python-engineio (>=3.2.2, <=3.8.2.post1)
python-engineio PYPI version =3.2.2, =0.1.1, =0.0.1, =0.8.21, =0.9.5, =0.13.6 Source cves: CVE-2019-13611 Source advisory: OSV:PYSEC-2019-170...
roslib-socketio code execution vulnerability
roslib-socketio is a ROS Robot Operating System JavaScript support library. A security vulnerability exists in roslib-socketio, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the...
Man-in-the-Middle (MitM)
roslib-socketio are vulnerable to man-in-the-middle MitM attacks. This is because the application downloads binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...
CVE-2016-10681
roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...
CVE-2016-10681
roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...
Remote code execution
roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...