CVE-2020-5931

On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly handle WebSockets related HTTP response headers, causing TMM to restart...

PT-2020-18829

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 through 11.6.5.2 F5 BIG-IP versions 12.1.0 through 12.1.5.2 F5 BIG-IP versions 13.1.0 through 13.1.3.4 F5 BIG-IP versions 14.1.0 through 14.1.2.3 F5 BIG-IP versions 15.1.0 through 15.1.0.5 Description The issue arises...

The vulnerability of the WebSockets API component of the CodeMeter license control application allows a perpetrator to gain unauthorized access to modify or create license files for CmActLicense.

The vulnerability of the WebSockets API of the CodeMeter license control application is related to a data source confirmation error. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to modify or create CmActLicense license files...

CodeMeter < 7.10a Multiple Vulnerabilities

According to its self-reported version, the CodeMeter WebAdmin server installed on the remote host is prior to 7.10a. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields. An...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

Design/Logic Flaw

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14519

CVE-2020-14519 affects CodeMeter WebAdmin’s internal WebSockets API. According to the provided documents, all versions prior to 7.00 are affected, including 7.0 or newer if the affected WebSockets API remains enabled, particularly when a web browser accesses the CodeMeter web server. The vulnerab...

CVE-2020-14519: Origin Validation Error

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

PT-2020-3962

Name of the Vulnerable Software and Affected Versions: CodeMeter versions prior to 7.00 Description: The issue is related to a component of the WebSockets API in the CodeMeter license control application, which is associated with a data source confirmation error. This can be exploited by a remote...

The vulnerability of the websockets.c component of the cross-platform library LibVNCServer allows a attacker to cause a service failure.

The vulnerability of the websockets.c component in the cross-platform library LibVNCServer is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failures...

DEBIAN-CVE-2020-15133

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connectionstarttls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not...

LibVNCServer Buffer Overflow Vulnerability (CNVD-2020-36778)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in a program. A buffer overflow vulnerability exists in the websockets.c file in versions of LibVNCServer prior to 9.12. The vulnerability stems from a web...

CVE-2017-18922

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container Updated rsyslog integration to not write world-readable configuration files CVE-2020-10782 Updated the included foreman/satellite inventory plugin to add the hostfilters and wantansiblesshhost options Updated Foreman/Satellite inventory to properly...

Information Disclosure

apollo-server-hapi is vulnerable to information leakage. Lack of validation rules enforcement during the subscription server creation with NoInstrospection rule for websockets exposes GraphQL schema types, their relations, human-readable names and many More information on the references...

Information Leakage

apollo-server-lambda is vulnerable to information leakage. Lack of validation rules enforcement during the subscription server creation with NoInstrospection rule for websockets exposes GraphQL schema types, their relations, human-readable names and many More information on the references...

Quantopian: Ability to perform various POST requests on quantopian.com as a different user - insecure by design.

Summary: Due to excessive control of victim's UI over algorithm collaboration feature one is able to force algorithm collaborator to issue malicious POST requests. Description: Hello again my favorite VDP! WebSockets again. Following vulnerability can be abused to attack a person that we...

Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection

Exploit Title: Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'userpassword' SQL Injection Date: 2020-03-30 Exploit Author: Jacob Baines Vendor Homepage: http://www.grandstream.com/ Software Link: http://www.grandstream.com/support/firmware/ucm62xx-official-firmware Version: 1.0.20.20 and below...