https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:06:35 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-06474 cnvd-2022-06474 https://cve.radiocsirt.org/vuln/cnvd-2022-06474 https://cve.radiocsirt.org/vuln/euvd-2026-234500 EUVD-2026-234500 https://cve.radiocsirt.org/vuln/euvd-2026-234500 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21691 <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-21691 https://cve.radiocsirt.org/vuln/ghsa-w9m4-7w72-r766 <p><strong>Affected:</strong> PyPI: onionshare-cli</p> <p>Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund&#39;s [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.</p> <p>- Vulnerability ID: OTF-004 - Vulnerability type: Improper Access Control - Threat level: Moderate</p> <p>## Description:</p> <p>Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> <p>## Technical description:</p> <p>  </p> <p>This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.</p> <p>This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler…</p> <p><strong>Affected:</strong> PyPI: onionshare-cli</p> <p>Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund&#39;s [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.</p> <p>- Vulnerability ID: OTF-004 - Vulnerability type: Improper Access Control - Threat level: Moderate</p> <p>## Description:</p> <p>Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> <p>## Technical description:</p> <p>  </p> <p>This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.</p> <p>This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler…</p> https://cve.radiocsirt.org/vuln/ghsa-w9m4-7w72-r766 https://cve.radiocsirt.org/vuln/gsd-2022-21691 gsd-2022-21691 https://cve.radiocsirt.org/vuln/gsd-2022-21691 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11983-1 <p>python-onionshare-2.5-1.1 on GA media</p> <p>python-onionshare-2.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:11983-1 https://cve.radiocsirt.org/vuln/pysec-2022-42 <p><strong>Affected:</strong> PyPI: onionshare-cli</p> <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> <p><strong>Affected:</strong> PyPI: onionshare-cli</p> <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> https://cve.radiocsirt.org/vuln/pysec-2022-42 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21691 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: onionshare, Ubuntu:24.04:LTS: onionshare, Ubuntu:25.04: onionshare</p> <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: onionshare, Ubuntu:24.04:LTS: onionshare, Ubuntu:25.04: onionshare</p> <p>OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21691