267 matches found
Vulnerability fixed in netmask
Netmask is a widely used component in various open source projects. This component contains a vulnerability. By incorrectly processing ipv4 addresses, attacks such as server-side request forgery SSRF, remote file inclusion RFI and local file inclusion LFI are made possible. The makers of Netmask...
The npm netmask vulnerability explained so you can actually understand it
The popular npm netmask library recently encountered a serious problem, explained as follows: The npm netmask package incorrectly evaluates individual ipv4 octets that contain octal strings as left-stripped integers, leading to an inordinate attack surface on hundreds of thousands of projects tha...
Server-Side Request Forgery (SSRF)
netmask is vulnerable to server-side request forgery SSRF. The package is not able to differentiate private IP addresses as external IP addresses, and would allow an attacker to trick the application into parsing an IP address incorrectly. Successful exploitation of the vulnerability depends on h...
Server-Side Request Forgery (SSRF)
netmask is vulnerable to server-side request forgery SSRF. The package is not able to differentiate private IP addresses as external IP addresses, and would allow an attacker to trick the application into parsing an IP address incorrectly. Successful exploitation of the vulnerability depends on h...
CVE-2021-28918
A flaw was found in nodejs-netmask. Octal input data may lead to a server-side request forgery, remote file inclusion, local file inclusion, and other vulnerabilities. The highest threat from this vulnerability is to data integrity...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
Improper access control
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
7ghost (>=4.11.0, <=4.11.46), @0x18b2ee/parse-server (>=3.10.1, <=3.11.0) +2861 more potentially affected by CVE-2021-29418 via netmask (>=0.0.2, <=1.0.6)
netmask NPM version =0.0.2, =4.11.0, =3.10.1, =0.1.0, =0.1.0, =1.6.1, =0.0.1, =2.0.0, =0.0.9, =0.0.175, =0.0.81, =2.0.0, =0.9.17-pre.6, =1.0.5 and more Source cves: CVE-2021-29418 Source advisory: MEND:CVE-2021-29418...
CVE-2021-29418
CVE-2021-29418 affects the Node.js netmask module, where the library mishandles certain unexpected characters in IP address strings (e.g., octal digit 9). This can allow a remote attacker to bypass access control based on IP addresses. The issue arises from an incomplete fix for CVE-2021-28918. A...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
CVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
Npm netmask input validation error vulnerability
Npm netmask is an application from Npm, Inc.The Netmask class parses and understands IPv4 CIDR blocks so that they can be explored and compared. An input validation error vulnerability exists in the netmask package before 2.0.1 for Node.js, which can be exploited by an attacker to bypass IP...
CVE-2021-29418: Improper Input Validation
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This in some situations allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for...
Npm netmask code issue vulnerability
nodejs is a JavaScript runtime environment based on the ChromeV8 engine through the Chromev8 engine for the packaging and the use of event-driven and non-blocking IO applications so that the development of high-performance Javascript background applications has become possible . Node.js netmask...
CVE-2021-29424
CVE-2021-29424 affects the Perl Net::Netmask module prior to 2.0000, where extraneous leading zero characters in IP addresses can bypass IP-based access control. Affected products include various Linux distributions (examples: Fedora, openSUSE, Mageia) and Astra Linux, with multiple advisories re...
CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which in some situations allows attackers to bypass access control that is based on IP addresses...
CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which in some situations allows attackers to bypass access control that is based on IP addresses...