websockets project websockets vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be ex...

Websockets Project Websockets 4.0

5.9

CVSSv3

The aaugustin websockets library prior to 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Websockets Project Websockets Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Cloud Native Core Unified Data Repository 1.14.0 Oracle Communications Cloud Native Core Service Communication Proxy 1.14.0 Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.5.0

9.8

CVSSv3

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handle...

Web Project Web

9.8

CVSSv3

A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.java. The manipulation leads to missing origin validation in websockets. The name of the patch is 620...

Gribbit Project Gribbit

7.5

CVSSv3

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unaut...

Soketi Project Soketi

5.3

CVSSv3

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425e...

Ws Project Ws Netapp E-series Performance Analyzer -

1 Github repository

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook