Socket.IO code-related vulnerabilities

Socket.IO is a JavaScript library for real-time web applications from Socket.IO. A security vulnerability exists in Socket.IO versions prior to 4.2.3, which stems from a specially crafted Socket.IO packet that can kill Node.js processes by triggering an uncaught exception on the Socket.IO server...

CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

CVE-2020-28502

An arbitrary code injection vulnerability was found in nodejs-xmlhttprequest. For this vulnerability to occur, the connection must be initialized during the function call XMLHttpRequest.open to send requests synchronously using the parameter async=False. If the subsequent calls to xhr.send...

Exploit for Missing Authentication for Critical Function in Siemens Tia_Administrator

The vulnerability is an authentication bypass in the TIA Adminis...

DEBIAN-CVE-2018-11798

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

[SECURITY] Fedora 28 Update: php-zendframework-zend-diactoros-1.8.4-1.fc28

A PHP package containing implementations of the accepted PSR-7 HTTP message interfaces 1, as well as a "server" implementation similar to node's http.Server 2. Documentation: https://zendframework.github.io/zend-diactoros/ Autoloader: /usr/share/php/Zend/Diactoros/autoload.php 1...

node-jose information disclosure vulnerability

node-jose is a web browser and node.js based server JSON object signing and encryption of open source library . A security vulnerability exists in versions of node-jose prior to 0.9.3. An attacker can exploit the vulnerability to obtain sensitive information...