CVE-2024-48849

Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...

CVE-2024-48849 Authentication and Authorization Issues

Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...

CVE-2024-48849

CVE-2024-48849 affects ABB FLXeon devices (firmware

CVE-2024-48849: Missing Origin Validation in WebSockets

Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through = 9.3.4...

Unauthorized Access

directus is vulnerable to Unauthorized Access. The vulnerability is due to improper authentication handling when WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH is set to "public," allowing unauthenticated users to perform CRUD operations and subscribe to changes with full admin privileges...

CVE-2024-54151

Directus vulnerability CVE-2024-54151 affects Directus real-time API/admin dashboard. From version 11.0.0 up to, but not including, 11.3.0, configuring WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH to "public" allows unauthenticated users to perform any supported operations (CRUD, subscriptions...

PT-2024-36074

Name of the Vulnerable Software and Affected Versions: Directus versions 11.0.0 through 11.2.x Description: Directus is a real-time API and App dashboard for managing SQL database content. When setting WEBSOCKETS GRAPHQL AUTH or WEBSOCKETS REST AUTH to "public", an unauthenticated user is able to...

This Week in Spring - December 3rd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the first week of December and I am in the amazing city of Perth, Australia. Perth, for those of you who don't know, is amazing. And well worth the journey. But it is quite the journey! 27 hours, door-to-door, from San...

[SECURITY] Fedora 40 Update: python-quart-0.19.8-1.fc40

Quart is an async Python web microframework. Using Quart you can, render and serve HTML templates, write RESTful JSON APIs, serve WebSockets, stream request and response data, do pretty much anything over the HTTP or WebSocket protocols...

[SECURITY] Fedora 41 Update: python-quart-0.19.8-1.fc41

Quart is an async Python web microframework. Using Quart you can, render and serve HTML templates, write RESTful JSON APIs, serve WebSockets, stream request and response data, do pretty much anything over the HTTP or WebSocket protocols...

Important: qt5-qtwebsockets

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

PT-2025-2806 · Flxeon · Flxeon

Name of the Vulnerable Software and Affected Versions: FLXEON versions through = 9.3.4 Description: The issue is related to a lack of origin validation in WebSockets, which allows unauthorized HTTPS requests due to insufficient session management. This can be exploited by a remote attacker to...

Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

Mattermost does not strip embeds from metadata when broadcasting posted events. This allows users to include arbitrary embeds in posts, which are then broadcasted via websockets. This can be exploited in many ways, for example to create permalinks with fully customizable content or to trigger a...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

CVE-2024-21550

The CVE-2024-21550 entry concerns SteVe, an open platform implementing OCPP for EV charging points. Affected component: SteVe management interface accessed over WebSockets. Root cause: attackers can inject arbitrary HTML/JavaScript via WebSockets, resulting in persistent Cross‑Site Scripting. Imp...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

PT-2024-18962 · Steve · Steve

Name of the Vulnerable Software and Affected Versions: SteVe affected versions not specified Description: SteVe is an open platform that implements different versions of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points...

CVE-2024-21550: Improper Neutralization of Input During Web Page Generation

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

How to Enable HTML5 Connections to Provisioning Services Based Catalogs

Enabling connections from Receiver for HTML5 to desktops deployed using Provisioning Services. Background Enabling connections from Receiver for HTML5 to desktops in Provisioning Services PVS based catalogs might require additional steps to complete depending on the persistence of the write cache...