Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,056 results · page 12 of 22
Jul 5, 2023The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commandCVE-2023-36622 · Other software · loxone · reported by MITREHigh 7.2
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.
- Product
- miniserver_go_gen_2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023In handle_set_parameters_ctrl of hal_socket.c, there is a possible out of bounds read due to an incorrect bounds check.CVE-2023-21150 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In handle_set_parameters_ctrl of hal_socket.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-267312009References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 2, 2023A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored.CVE-2023-23602 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 31, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-35753 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 31, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-35752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 31, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-35745 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 30, 2023A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request.CVE-2023-2968 · Other software · Proxy Project · reported by reefs@jfrog.comHigh 7.5
A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.
- Product
- Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.jfrog.comresearch.jfrog.com
May 27, 2023socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol.CVE-2023-32695 · Other software · socketio · reported by GitHubHigh 7.3
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
- Product
- socket.io-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel.CVE-2023-2002 · Computers, phones & browsers · Linux · reported by Red HatMedium 6.8
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
May 25, 2023Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.CVE-2023-2886 · Other software · CBOT · reported by iletisim@usom.gov.trMedium 4.3
Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
- Product
- Chatbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
May 11, 2023A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by CVE-2023-28361 · Other software · UNI · reported by support@hackerone.comMedium 6.5
A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.
- Product
- Unifi OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
May 9, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2023-24903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 8, 2023Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.CVE-2023-31125 · Other software · socketio · reported by GitHubMedium 6.5
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.
- Product
- engine.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain liCVE-2023-2534 · Other software · OTRS AG · reported by security@otrs.comHigh 7.6
Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e. g. via ticket histories by any user. (Fuzzing for garnering other adjacent user/sensitive data). Subscribing to all possible push events could also lead to performance implications on the server side, depending on the size of the installation and the number of active users. (Flooding)This issue affects OTRS: from 8.0.X before 8.0.32.
- Product
- OTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients.CVE-2023-2281 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 20, 2023On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack withCVE-2023-25601 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.3
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Apr 11, 2023Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service VulnerabilityCVE-2023-28241 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 8, 2023socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a prCVE-2023-24626 · Other software · GNU · reported by MITREMedium 6.5
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
- Product
- Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orgsavannah.gnu.org
Apr 4, 2023The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the deviCVE-2023-1751 · Other software · Nexx · reported by ics-cert@hq.dhs.govHigh 7.5
The listed versions of Nexx Smart Home devices use a WebSocket server that does not validate if the bearer token in the Authorization header belongs to the device attempting to associate. This could allow any authorized user to receive alarm information and signals meant for other devices which leak a deviceId.
- Product
- Smart Alarm NXAL-100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2023 NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket.CVE-2023-0208 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.4
NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.
- Product
- DCGM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Mar 27, 2023A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol.CVE-2023-1078 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.8
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgit.kernel.org
Mar 23, 2023Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.CVE-2023-26114 · Other software · Coder · reported by report@snyk.ioHigh 8.2
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
- Product
- Code-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a lCVE-2023-26464 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Log4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgsecurity.netapp.com
Feb 25, 2023Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains rCVE-2023-26103 · Other software · Deno · reported by report@snyk.ioMedium 5.3
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.
- Product
- Deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API.CVE-2022-48308 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.3
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service.
- Product
- sls-logging
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API.CVE-2022-48307 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.3
It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.
- Product
- Foundry Magritte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API.CVE-2022-27890 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 6.3
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution.
- Product
- AtlasDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv().CVE-2022-28331 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
- Product
- Apache Portable Runtime (APR)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 12, 2023NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code executiCVE-2022-42273 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.1
NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution.
- Product
- NVIDIA DGX servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 10, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2023-21548 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2023-21535 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 29, 2022Gotify server is a simple server for sending and receiving messages in real-time per WebSocket.CVE-2022-46181 · Other software · gotify · reported by GitHubMedium 6.1
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to CVE-2021-4236 · Other software · github.com/ecnepsnai/web · reported by security@golang.orgCritical 9.8
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
- Product
- github.com/ecnepsnai/web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-44676 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-44670 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket.CVE-2022-31696 · Other software · VMware · reported by security@vmware.comHigh 8.8
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.CVE-2022-41940 · Other software · socketio · reported by GitHubHigh 7.1
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
- Product
- engine.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022@fastify/websocket provides WebSocket support for Fastify.CVE-2022-39386 · Other software · fastify · reported by GitHubHigh 7.5
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
- Product
- fastify-websocket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to CVE-2022-2421 · Other software · Socket.io · reported by csirt@divd.nlCritical 10
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
- Product
- Socket.io-Parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Oct 17, 2022socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding.CVE-2022-42975 · Other software · Phoenixframework · reported by MITREHigh 7.5
socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
- Product
- Phoenix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2022Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit.CVE-2022-39292 · Other software · abdolence · reported by GitHubHigh 7.5
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
- Product
- slack-morphism-rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables.CVE-2022-30121 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.7
The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their system.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Sep 23, 2022TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client,CVE-2022-33682 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.9
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
- Product
- Apache Pulsar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 21, 2022In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operaCVE-2022-23950 · Other software · Keylime · reported by patrick@puiterwijk.orgHigh 7.5
In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
- Product
- Keylime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received.CVE-2022-37797 · Other software · Lighttpd · reported by MITREHigh 7.5
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
- Product
- Lighttpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgredmine.lighttpd.net
Sep 2, 2022Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon AutoCVE-2022-22098 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon Auto
- Product
- Snapdragon Auto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 24, 2022A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a CVE-2021-4028 · Computers, phones & browsers · Linux · reported by Red HatHigh 7.8
A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this use-after-free to crash the system or possibly escalate privileges on the system.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 15, 2022A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to EteCVE-2022-24951 · Other software · Jason Gauci · reported by cve-assign@fb.comHigh 7
A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
- Product
- Eternal Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Aug 15, 2022A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabliCVE-2022-24950 · Other software · Jason Gauci · reported by cve-assign@fb.comHigh 7.5
A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().
- Product
- Eternal Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Aug 9, 2022Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-35794 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.