15 matches found
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
CVE-2026-70490 Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, the terminal WebSocket route in backend/openwebui/routers/terminals.py authenticated its own first-message JWT and never applied the verified-user role gate that getverifieduser enforces...
Malicious code in @whalent/agent-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...
The vulnerability of the clipboard management function in the terminal session of Windows Clipboard Server operating systems allows attackers to enhance their privileges.
The vulnerability of the clipboard management function in the terminal session of Windows Clipboard Server operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the clipboard management function in the terminal session of Windows Clipboard Server operating systems allows attackers to enhance their privileges.
The vulnerability of the clipboard management function in the terminal session of Windows Clipboard Server operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to increase their privileges...
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API
Impact LXD's operations API includes secret values necessary for WebSocket connections when retrieving information about running operations. These secret values are used for authentication of WebSocket connections for terminal and console sessions. Therefore, attackers with only read permissions...
DEBIAN-CVE-2025-54289
Privilege Escalation in operations API in Canonical LXD 6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format...
CVE-2025-54289 Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Privilege Escalation in operations API in Canonical LXD 6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format...
PT-2023-5573 · Unknown · Jumpserver
Name of the Vulnerable Software and Affected Versions: JumpServer versions 3.0.0 through 3.5.4 JumpServer versions 3.6.0 through 3.6.3 Description: The issue is related to a weakness in the authentication procedure of JumpServer, an open-source bastion host and professional operation and...
CVE-2023-42442: Improper Authentication
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...
A New Linux Malware Targeting High-Performance Computing Clusters
High-performance computing clusters belonging to university networks as well as servers associated with government agencies, endpoint security vendors, and internet service providers have been targeted by a newly discovered backdoor that gives attackers the ability to execute arbitrary commands o...
Multiple terminal clients X sessions hijack
Terminal always opens :0 display if DISPLAY is not set...
Fedora Core 5 : kdebase-3.5.3-0.3.fc5 (2006-726)
Thu Jun 15 2006 Than Ngo 6:3.5.3-0.3.fc5 - fix BR - Wed Jun 14 2006 Than Ngo 6:3.5.3-0.2.fc5 - apply patch to to fix 194659, CVE-2006-2449 KDM symlink attack vulnerability thanks to KDE security team - Thu Jun 8 2006 Than Ngo 6:3.5.3-0.1.fc5 - update to 3.5.3 - Fri May 12 2006 Than Ngo...