Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers

The Mozilla Foundation Security Advisory describes this flaw as: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers...

OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

PT-2023-1503 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.4 through 7.5 Description: The issue is related to the disclosure of information in the IBM QRadar SIEM system. It allows an attacker to expose protected information. The problem arises from the copying of certifica...

PT-2023-8498

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3 Description The issue is related to the IPv6 implementation in the Linux kernel, specifically with the net/ipv6/route.c file. It involves incorrect handling of boundary conditions, potentially allowing a remo...

CVE-2023-21768

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability...

K20105555: F5 SSL Orchestrator may fail to stop an attacker from exfiltrating data on a compromised client system (SNIcat)

Security Advisory Description An attacker may be able to exfiltrate data from a target system sitting behind F5 SSL Orchestrator by inserting data into the TLS SNI field. This approach assumes that the attacker has already compromised, and is in full control of, the target system to be able to...

GHSA-JPGG-CP2X-QRW3 Duplicate Advisory: ecnepsnai/web vulnerable to Uncontrolled Resource Consumption

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5gjg-jgh4-gppm. This link is maintained to preserve external references. Original Description Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if t...

Duplicate Advisory: ecnepsnai/web vulnerable to Uncontrolled Resource Consumption

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5gjg-jgh4-gppm. This link is maintained to preserve external references. Original Description Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if t...

CVE-2021-4236

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

CVE-2021-4236

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

Authentication flaw

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

CVE-2021-4236

CVE-2021-4236 affects github.com/ecnepsnai/web. WebSockets with an AuthenticateMethod hook do not execute any AuthenticateMethod, enabling a nil pointer dereference if UserData is assumed non-nil or allowing authentication bypass. Non-WebSocket request handlers are not vulnerable. No remediation/...

CVE-2021-4236

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

CVE-2021-4236 Panic or authentication bypass in github.com/ecnepsnai/web

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

CVE-2021-4236: NULL Pointer Dereference

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

Fedora 36 : device-mapper-multipath (2022-6ec78b2586)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6ec78b2586 advisory. Security fix for CVE-2022-41973 and CVE-2022-41974 Tenable has extracted the preceding description block directly from the Fedora security advisory...

PT-2025-53956

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to TCP socket handling. Specifically, the sk error queue is not properly purged during socket closure, potentially leading to memory leaks and...

PT-2025-40132

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc7-02243-gb84a13ff4eda Description A crash can occur in the Bluetooth stack when attempting to connect multiple ISO sockets without using DEFER SETUP. This issue is related to a null-ptr-deref in the hci...

PT-2022-27427 · Slixmpp +1 · Slixmpp +1

Name of the Vulnerable Software and Affected Versions: Slixmpp versions prior to 1.8.3 Description: The issue lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. Recommendations: For versions prior to 1.8.3, update to version...