debian/novnc vulnerabilities

Latest debian/novnc CVEs

Newest publication first

1. DLA-2854-1 novnc - security update

   Published 2021-12-27

   Unknown

2. DLA-1946-1 novnc - security update

   Published 2019-10-05

   Unknown

3. CVE-2017-18635 Cross-Site Scripting in @novnc/novnc

   Published 2019-09-25

   Medium·CVSS 6.1 EPSS 4.8% PoC

   An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

4. CVE-2013-7436 noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http sessio...

   Published 2015-04-10

   Medium·CVSS 4.3 EPSS 2.2%

   noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.