Vulnerabilities > Facebook
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-16 | CVE-2024-23347 | Unspecified vulnerability in Facebook Meta Spark Studio Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. | 7.8 |
| 2023-11-28 | CVE-2023-49062 | Improper Initialization vulnerability in Facebook Katran Katran could disclose non-initialized kernel memory as part of an IP header. | 7.5 |
| 2023-10-19 | CVE-2023-5654 | Unspecified vulnerability in Facebook React-Devtools The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. | 6.5 |
| 2023-10-10 | CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | 7.5 |
| 2023-10-06 | CVE-2023-45239 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent to tac_plus to inject shell commands and gain remote code execution on the tac_plus server. | 9.8 |
| 2023-05-18 | CVE-2023-23556 | Out-of-bounds Write vulnerability in Facebook Hermes An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. | 9.8 |
| 2023-05-18 | CVE-2023-23557 | Type Confusion vulnerability in Facebook Hermes An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. | 9.8 |
| 2023-05-18 | CVE-2023-23759 | Reachable Assertion vulnerability in Facebook Fizz There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. | 7.5 |
| 2023-05-18 | CVE-2023-24832 | NULL Pointer Dereference vulnerability in Facebook Hermes A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. | 7.5 |
| 2023-05-18 | CVE-2023-24833 | Use After Free vulnerability in Facebook Hermes A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. | 7.5 |