Vendor
154 known vulnerabilities.
Products
HHVM 32
WhatsApp for Android 23
WhatsApp Business for Android 20
Hermes 20
WhatsApp for iOS 19
proxygen 16
WhatsApp Business for iOS 15
Facebook Thrift 11
WhatsApp Desktop 5
WhatsApp for Windows Phone 4
WhatsApp Desktop for Mac 4
WhatsApp Desktop for Windows 4
mvfst 4
fizz 3
folly 3
Zstandard 3
osquery 3
Facebook for WooCommerce 3
Wangle 2
WhatsApp Android 2
WhatsApp iPhone 2
WhatsApp Business for iPhone 2
Mcrouter 2
Oculus Desktop 2
react-dev-utils 2
Redex 1
WhatsApp for KaiOS 1
Katran 1
WhatsApp Enterprise Client 1
Facebook Gameroom 1
WhatsApp for Tizen 1
WhatsApp for Portal 1
ParlAI 1
react-native 1
Facebook Chat Plugin – Live Chat Plugin for WordPress 1
netconsd 1
Facebook for WordPress 1
Buck 1
react-dom 1
Nuclide 1
154 results · Feed
-
Unscored —
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send f…
-
Unscored —
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious …
-
Unscored —
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data be…
-
Unscored —
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects Wh…
-
Unscored —
When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for…
-
Unscored —
When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a s…
-
Unscored —
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard …
-
Critical 9.8
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RT…
KEV Apr 19, 2022 -
Unscored —
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over …
-
Unscored —
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a …
-
Unscored —
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown t…
-
Unscored —
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers …
-
Unscored —
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a re…
-
High 7.5
Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of servi…
-
Unscored —
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects …
-
Unscored —
Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to …
-
Unscored —
An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denia…
-
Unscored —
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively…
-
Unscored —
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 c…
-
Unscored —
Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential de…
-
Critical 9.8
Nuclide Improper Input Validation
The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chain…
-
Critical 9.8
Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously craft…
-
High 7.5
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circula…
-
High 7.5
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in …
-
Medium 6.1CVE-2018-6341 Public exploit
Cross-Site Scripting in react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x,…
-
Critical 9.8
react-dev-utils on Windows vulnerable to Remote Code Execution
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the ser…
-
High 7.5
A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulne…
-
High 7.5
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This aff…
-
High 7.5
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of ser…
-
High 8.1
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires co…
-
Critical 9.8
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not…
-
High 7.8
An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing check…
-
High 7.5
A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to…
-
Medium 5.9
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to sp…