CVE-2023-30856

CRITICAL Year: 2023
CVSS v3 Score
10.0
Critical
Weakness Type
CWE-346
View all →

Vulnerability Description

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.

Related Vulnerabilities

CVE-2000-1218

CRITICAL
CVSS:9.8(Critical)

The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS updates from hosts tha...

CWE-3462000

CVE-2003-0174

CRITICAL
CVSS:9.8(Critical)

The LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could allow attackers to log in without a passw...

CWE-3462003

CVE-2017-13274

CRITICAL
CVSS:9.8(Critical)

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges neede...

CWE-3462017

CVE-2017-20146

CRITICAL
CVSS:9.8(Critical)

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the...

CWE-3462017

CVE-2018-15723

CRITICAL
CVSS:9.8(Critical)

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to ex...

CWE-3462018

CVE-2018-5116

CRITICAL
CVSS:9.8(Critical)

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins ...

CWE-3462018