Filtered by vendor Facebook
Subscribe
Total
120 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-1912 | 1 Facebook | 1 Hermes | 2023-11-07 | 6.8 MEDIUM | 8.1 HIGH |
| An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. | |||||
| CVE-2019-3565 | 1 Facebook | 1 Thrift | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00. | |||||
| CVE-2019-3564 | 1 Facebook | 1 Thrift | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00. | |||||
| CVE-2019-3560 | 1 Facebook | 1 Fizz | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on user input. This issue affected versions of fizz prior to v2019.03.04.00. | |||||
| CVE-2019-3559 | 1 Facebook | 1 Thrift | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. | |||||
| CVE-2019-3558 | 1 Facebook | 1 Thrift | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. | |||||
| CVE-2019-3552 | 1 Facebook | 1 Thrift | 2023-11-07 | 5.0 MEDIUM | 7.5 HIGH |
| C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00. | |||||
| CVE-2016-1000006 | 1 Facebook | 1 Hhvm | 2023-11-07 | 7.5 HIGH | 9.8 CRITICAL |
| hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions. | |||||
| CVE-2023-5654 | 1 Facebook | 1 React-devtools | 2023-10-27 | N/A | 6.5 MEDIUM |
| The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser. | |||||
| CVE-2021-24036 | 1 Facebook | 2 Folly, Hhvm | 2022-10-26 | 7.5 HIGH | 9.8 CRITICAL |
| Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1. | |||||
| CVE-2022-40138 | 1 Facebook | 1 Hermes | 2022-10-11 | N/A | 9.8 CRITICAL |
| An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected. | |||||
| CVE-2022-35289 | 1 Facebook | 1 Hermes | 2022-10-11 | N/A | 9.8 CRITICAL |
| A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. | |||||
| CVE-2022-32234 | 1 Facebook | 1 Hermes | 2022-10-11 | N/A | 9.8 CRITICAL |
| An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. | |||||
| CVE-2022-27810 | 1 Facebook | 1 Hermes | 2022-10-11 | N/A | 7.5 HIGH |
| It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0. | |||||
| CVE-2020-1920 | 1 Facebook | 1 React-native | 2022-10-06 | 5.0 MEDIUM | 7.5 HIGH |
| A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1. | |||||
| CVE-2020-20093 | 1 Facebook | 1 Messenger | 2022-03-30 | 4.3 MEDIUM | 6.5 MEDIUM |
| The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages. | |||||
| CVE-2020-20094 | 1 Facebook | 1 Instagram | 2022-03-30 | 4.3 MEDIUM | 6.5 MEDIUM |
| Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages | |||||
| CVE-2021-24044 | 1 Facebook | 1 Hermes | 2022-01-24 | 7.5 HIGH | 9.8 CRITICAL |
| By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0. | |||||
| CVE-2021-24045 | 1 Facebook | 1 Hermes | 2021-12-15 | 6.8 MEDIUM | 9.8 CRITICAL |
| A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. | |||||
| CVE-2019-3556 | 1 Facebook | 1 Hhvm | 2021-10-29 | 5.5 MEDIUM | 8.1 HIGH |
| HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0. | |||||