CWE-940
AllowedImproper Verification of Source of a Communication Channel
Abstraction: Base · Status: Incomplete
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
102 vulnerabilities reference this CWE, most recent first.
GHSA-84R6-PWMM-H2FW
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
{
"affected": [],
"aliases": [
"CVE-2025-40820"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:17:46Z",
"severity": "HIGH"
},
"details": "Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.",
"id": "GHSA-84r6-pwmm-h2fw",
"modified": "2025-12-09T18:30:36Z",
"published": "2025-12-09T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40820"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915282.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8F27-8FR7-2363
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2025-01-24 18:31An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
{
"affected": [],
"aliases": [
"CVE-2025-23222"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T17:15:15Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don\u0027t know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn\u0027t be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.",
"id": "GHSA-8f27-8fr7-2363",
"modified": "2025-01-24T18:31:13Z",
"published": "2025-01-24T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23222"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1229918"
},
{
"type": "WEB",
"url": "https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2025/01/24/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-96F7-VMP7-7RVH
Vulnerability from github – Published: 2026-06-18 18:35 – Updated: 2026-06-18 18:35The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
{
"affected": [],
"aliases": [
"CVE-2026-54106"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-18T17:16:33Z",
"severity": "MODERATE"
},
"details": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.",
"id": "GHSA-96f7-vmp7-7rvh",
"modified": "2026-06-18T18:35:24Z",
"published": "2026-06-18T18:35:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54106"
},
{
"type": "WEB",
"url": "https://epds.gao.gov"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54106"
},
{
"type": "WEB",
"url": "https://www.eds.cbca.gov/login"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-97F3-2864-45MW
Vulnerability from github – Published: 2026-09-04 09:31 – Updated: 2026-09-04 09:31The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.
{
"affected": [],
"aliases": [
"CVE-2026-85085"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T07:17:11Z",
"severity": "CRITICAL"
},
"details": "The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user\u2019s session.",
"id": "GHSA-97f3-2864-45mw",
"modified": "2026-09-04T09:31:59Z",
"published": "2026-09-04T09:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85085"
},
{
"type": "WEB",
"url": "https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9HJV-9H75-XMPP
Vulnerability from github – Published: 2022-05-14 01:18 – Updated: 2024-02-22 19:41The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.68"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.32"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.0.M2"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0M1"
},
{
"fixed": "9.0.0.M3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-0763"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T20:06:41Z",
"nvd_published_at": "2016-02-25T01:59:00Z",
"severity": "MODERATE"
},
"details": "The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.",
"id": "GHSA-9hjv-9h75-xmpp",
"modified": "2024-02-22T19:41:03Z",
"published": "2022-05-14T01:18:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/76ebc9007567c8326217dd94844540e1e27d8468"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/c08641da04d31f730b56b8675301e55db97dfe88"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/0531f7aeff1999d362e0a68512a3517f2cf1a6ae"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160404202803/http://www.securitytracker.com/id/1035069"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160314101138/http://www.securityfocus.com/bid/83326"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725926"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725929"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725931"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Improper Verification of Source of a Communication Channel in Apache Tomcat"
}
GHSA-9PPW-9F8W-5R25
Vulnerability from github – Published: 2024-02-14 18:30 – Updated: 2024-02-14 18:30An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
{
"affected": [],
"aliases": [
"CVE-2024-0009"
],
"database_specific": {
"cwe_ids": [
"CWE-346",
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-14T18:15:47Z",
"severity": "MODERATE"
},
"details": "An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.",
"id": "GHSA-9ppw-9f8w-5r25",
"modified": "2024-02-14T18:30:26Z",
"published": "2024-02-14T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0009"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2024-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-C35G-JR5F-H83P
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2024-10-22 17:28An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.2.3"
},
"package": {
"ecosystem": "PyPI",
"name": "slixmpp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.3.1"
},
"package": {
"ecosystem": "PyPI",
"name": "SleekXMPP"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5591"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T23:06:53Z",
"nvd_published_at": "2017-02-09T20:59:00Z",
"severity": "MODERATE"
},
"details": "An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application\u0027s display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.",
"id": "GHSA-c35g-jr5f-h83p",
"modified": "2024-10-22T17:28:45Z",
"published": "2022-05-13T01:28:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5591"
},
{
"type": "WEB",
"url": "https://github.com/fritzy/SleekXMPP/issues/442"
},
{
"type": "WEB",
"url": "https://github.com/fritzy/SleekXMPP/commit/285495d5ee2427d93d961ceedcd1829383e5196d"
},
{
"type": "WEB",
"url": "https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8"
},
{
"type": "PACKAGE",
"url": "https://github.com/poezio/slixmpp"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/sleekxmpp/PYSEC-2017-103.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2017-104.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/sleekxmpp"
},
{
"type": "WEB",
"url": "https://pypi.org/project/slixmpp"
},
{
"type": "WEB",
"url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons"
},
{
"type": "WEB",
"url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227192025/http://www.securityfocus.com/bid/96166"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/02/09/29"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons "
}
GHSA-C6H3-VH8H-R8MJ
Vulnerability from github – Published: 2026-02-23 06:30 – Updated: 2026-02-23 06:30A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-2967"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-23T04:16:02Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-c6h3-vh8h-r8mj",
"modified": "2026-02-23T06:30:18Z",
"published": "2026-02-23T06:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2967"
},
{
"type": "WEB",
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md"
},
{
"type": "WEB",
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.347334"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.347334"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.755450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C86M-WFX2-QMX9
Vulnerability from github – Published: 2023-08-03 12:31 – Updated: 2024-04-04 06:30In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
{
"affected": [],
"aliases": [
"CVE-2023-3663"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T11:15:10Z",
"severity": "HIGH"
},
"details": "In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.",
"id": "GHSA-c86m-wfx2-qmx9",
"modified": "2024-04-04T06:30:56Z",
"published": "2023-08-03T12:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3663"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2023-022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C9Q3-F5V3-G7HW
Vulnerability from github – Published: 2024-06-17 18:31 – Updated: 2024-08-14 15:31TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router.
{
"affected": [],
"aliases": [
"CVE-2024-37662"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T18:15:17Z",
"severity": "MODERATE"
},
"details": "TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router.",
"id": "GHSA-c9q3-f5v3-g7hw",
"modified": "2024-08-14T15:31:11Z",
"published": "2024-06-17T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37662"
},
{
"type": "WEB",
"url": "https://github.com/ouuan/router-vuln-report/blob/master/nat-rst/tl-7dr5130-nat-rst.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
- When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
CAPEC-500: WebView Injection
An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.
CAPEC-594: Traffic Injection
An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.
CAPEC-595: Connection Reset
In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.
CAPEC-596: TCP RST Injection
An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.