CVE-2024-38355

HIGH Year: 2024
CVSS v3 Score
7.3
High
Weakness Type
CWE-20
View all →

Vulnerability Description

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `[email protected]` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Related Vulnerabilities

CVE-2009-5147

HIGH
CVSS:7.3(High)

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

CWE-202009

CVE-2013-0165

HIGH
CVSS:7.3(High)

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.

CWE-202013

CVE-2013-4245

HIGH
CVSS:7.3(High)

Orca has arbitrary code execution due to insecure Python module load

CWE-202013

CVE-2015-6863

HIGH
CVSS:7.3(High)

HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component.

CWE-202015

CVE-2015-6934

HIGH
CVSS:7.3(High)

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow ...

CWE-202015

CVE-2015-8607

HIGH
CVSS:7.3(High)

The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypa...

CWE-202015