WS-2019-0289

Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP,...

Configuration Override in helmet-csp

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application'...

GHSA-C3M8-X3CG-QM2C Configuration Override in helmet-csp

Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application'...

1405_logging (1.0.0), @airy/maleo (>=0.0.1-canary.49, <=0.3.1-canary.36) +300 more potentially affected by unknown CVE via helmet-csp (>=1.2.2, <=2.9.0)

helmet-csp NPM version =1.2.2, =0.0.1-canary.49, =0.1.0, =1.0.22, =0.1.1-alpha.0, =0.1.0, =1.5.0, =0.1.0-alpha1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-C3M8-X3CG-QM2C...

PT-2020-21221

Name of the Vulnerable Software and Affected Versions helmet-csp versions prior to 2.9.1 Description The issue affects the application's Content Security Policy CSP by allowing an attacker to remove the default CSP, potentially rendering the application vulnerable to Cross-Site Scripting. This is...

Configuration Override

Overview Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an...