#cwe-1385

共收录 30 条相关情报。

漏洞预警2026-10-23 发布MEDIUM

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket end...

CVE-2026-55463

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11

来源摘录 · NVD

#cve #cwe-1385 #cwe-306 #cwe-862

漏洞预警2026-10-22 发布HIGH

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to ...

CVE-2026-112085

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 a

来源摘录 · NVD

#cve #cwe-1385 #cwe-346

漏洞预警2026-10-20 发布INFO

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell ses...

CVE-2026-85267

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an una

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

漏洞预警2026-10-12 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin head...

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable

历史摘要 · 未重新核验 · NVD

#cve #cwe-346 #cwe-1385

安全公告2026-10-12 发布INFO

obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1385 #cwe-346

漏洞预警2026-10-12 发布INFO

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handle...

CVE-2026-109330

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows re

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

安全公告2026-10-12 发布INFO

Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

CVE-2026-109330

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows re

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1385

安全公告2026-10-06 发布INFO

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route...

CVE-2026-104380

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-1385

漏洞预警2026-10-06 发布INFO

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshak...

CVE-2026-104380

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

安全公告2026-10-02 发布INFO

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

CVE-2026-71416

### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests be

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-287 #cwe-1385 #severity:high

漏洞预警2026-09-23 发布INFO

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mq...

CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the W

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

漏洞预警2026-09-17 发布INFO

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs ho...

CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox e

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359 #cwe-918 #cwe-1385

漏洞预警2026-09-11 发布INFO

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming...

CVE-2026-71416

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket

历史摘要 · 未重新核验 · NVD

#cve #cwe-287 #cwe-1385

漏洞预警2026-09-10 发布INFO

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-fi...

CVE-2026-88061

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops loca

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-1385

安全公告2026-09-10 发布INFO

career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

CVE-2026-88061

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops loca

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1385 #cwe-352

漏洞预警2026-09-03 发布INFO

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim appl...

CVE-2026-85183

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to es

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

安全公告2026-09-03 发布INFO

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

CVE-2026-85183

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to es

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1385

安全公告2026-08-21 发布INFO

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows...

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-1385 #severity:medium

漏洞预警2026-08-21 发布INFO

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3...

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-1385

安全公告2026-07-16 发布INFO

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

CVE-2026-59950

### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) ac

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-346 #cwe-1385 #severity:high