10tcl (>=0.0.1, <=0.0.10), 317-project (0.0.0) +2427 more potentially affected by CVE-2014-6393 via express (>=3.0.0, <=3.10.5)

express NPM version =3.0.0, =0.0.1, =0.0.1, =0.0.1, =0.25.0, =1.0.4, =0.0.1, =0.0.4, =0.0.1, =0.0.6 and more Source cves: CVE-2014-6393 Source advisory: OSV:GHSA-GPVR-G6GH-9MC2...

1405-authtokens (>=1.0.1, <=1.0.5), 2048.io (0.0.1) +471 more potentially affected by CVE-2014-6393 via express (>=4.0.0, <=4.4.5)

express NPM version =4.0.0, =1.0.1, =1.0.0, =0.0.5-SNAPSHOT.11, =0.1.0, =0.0.5-SNAPSHOT.11, =0.0.5-SNAPSHOT.11, =0.0.5-SNAPSHOT.11, =0.0.5-SNAPSHOT.11, =0.0.7, =0.0.1, =1.3.2-1, =1.3.2-2 - alexa-app 1.0.0 and more Source cves: CVE-2014-6393 Source advisory: OSV:GHSA-GPVR-G6GH-9MC2...

CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

CVE-2014-6393

CVE-2014-6393 affects the Express web framework for Node.js (versions prior to 3.11 and 4.x prior to 4.5). Root cause: missing charset field in HTTP Content-Type headers for 400-level responses, enabling potential XSS via non-standard encodings. Affected component/file: Express’s Content-Type han...