Vendor
154 known vulnerabilities.
Products
HHVM 32
WhatsApp for Android 23
WhatsApp Business for Android 20
Hermes 20
WhatsApp for iOS 19
proxygen 16
WhatsApp Business for iOS 15
Facebook Thrift 11
WhatsApp Desktop 5
WhatsApp for Windows Phone 4
WhatsApp Desktop for Mac 4
WhatsApp Desktop for Windows 4
mvfst 4
fizz 3
folly 3
Zstandard 3
osquery 3
Facebook for WooCommerce 3
Wangle 2
WhatsApp Android 2
WhatsApp iPhone 2
WhatsApp Business for iPhone 2
Mcrouter 2
Oculus Desktop 2
react-dev-utils 2
Redex 1
WhatsApp for KaiOS 1
Katran 1
WhatsApp Enterprise Client 1
Facebook Gameroom 1
WhatsApp for Tizen 1
WhatsApp for Portal 1
ParlAI 1
react-native 1
Facebook Chat Plugin – Live Chat Plugin for WordPress 1
netconsd 1
Facebook for WordPress 1
Buck 1
react-dom 1
Nuclide 1
154 results · Feed
-
Unscored —
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for …
-
Unscored —
A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or What…
-
Unscored —
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the applicatio…
-
High 8.1
Signed to Unsigned Conversion Error in Facebook Hermes
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploi…
-
High 8.1
Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes
An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note …
-
Critical 9.8
Access of Resource Using Incompatible Type in Facebook Hermes
A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via craft…
-
Unscored —
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, What…
-
Unscored —
A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android…
-
Unscored —
A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 cou…
-
Unscored —
A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could ha…
-
Unscored —
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape i…
-
Unscored —
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon …
-
Unscored —
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invo…
-
Unscored —
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted di…
-
Unscored —
Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows…
-
High 7.5
Golang Facebook Thrift servers vulnerable to denial of service
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to deni…
-
Unscored —
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker t…
-
Unscored —
C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the paylo…
-
Unscored —
Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payl…
-
Unscored —
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. Thi…
-
Unscored —
Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially …
-
Unscored —
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to D…
-
High 8.2
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2…
KEV May 23, 2022 -
Unscored —
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operation…
-
Unscored —
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue …
-
Unscored —
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This is…
-
Unscored —
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects foll…
-
Unscored —
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. T…
-
Unscored —
In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaust…
-
Unscored —
In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no ma…
-
Unscored —CVE-2019-11931 Public exploit
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user…
-
Unscored —CVE-2019-11933 Public exploit
A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.1…
-
Unscored —
Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory,…
-
Unscored —
An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on t…
-
Unscored —
Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to…
-
Unscored —
Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-…
-
Unscored —
A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshak…
-
Unscored —
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper…
-
Unscored —
A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to w…
-
Unscored —
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r an…