CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

Input validation

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406 Remote Code Execution (RCE)

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

7ghost (>=4.11.0, <=4.11.46), @0x18b2ee/parse-server (>=3.10.1, <=3.11.0) +3382 more potentially affected by CVE-2021-23406 via pac-resolver (>=1.2.6, <=4.2.0)

pac-resolver NPM version =1.2.6, =4.11.0, =3.10.1, =0.1.0, =0.1.0, =0.0.1, =1.6.1, =0.0.1, =0.2.2, =0.2.2, =0.0.1, =2.0.0, =2.4.18 and more Source cves: CVE-2021-23406 Source advisory: MEND:CVE-2021-23406...

CVE-2021-23406

Technical details about CVE-2021-23406 are not provided in the connected documents. Public details appear limited to the initial description. Monitor for updates from official advisories.

CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

pac-resolver security vulnerability

pac-resolver is a function that generates an asynchronous parser from a PAC file. A security vulnerability exists in pac-resolver versions prior to 5.0.0 that stems from the application of insecure PAC file handling, which may occur when used with untrusted input...

PT-2021-15497

Name of the Vulnerable Software and Affected Versions pac-resolver versions prior to 5.0.0 Description This issue occurs due to unsafe PAC file handling when used with untrusted input, allowing for potential remote code execution. The pac-resolver package has over 3 million weekly downloads, and...

CVE-2021-23406: Undefined Security Weakness

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

FAQ: Citrix Secure Web and Proxy Support

This article answers the frequently asked questions on Secure Web and Web proxy support. For more information about Secure Web and proxy support, refer to Citrix Documentation - Citrix Secure Web. The support for PAC file inMDX application is removed as of September 2021. This means Citrix has...

Schneider Modicon PAC Controller Has Industrial Control Device Vulnerability

The Schneider Electric M340 is mid-range PAC industrial process and infrastructure control. The Schneider Electric M340 has an industrial control device vulnerability that can be exploited by an attacker to remotely obtain a backdoor password, which can be used to connect to a password-protected...

Authorization Bypass Vulnerability in Schneider Electric Modicon PAC M580, M340

Schneider Electric SA is a global electrical company headquartered in France. An authorization bypass vulnerability exists in the Schneider Electric Modicon PAC M580, M340, which can be exploited by an attacker to cause a denial of service...

CISA Releases Security Advisory for Philips Vue PAC Products

CISA has released an Industrial Controls Systems ICS Medical Advisory detailing multiple vulnerabilities in multiple Philips Clinical Collaboration Platform Portal officially registered as Vue PACS products. An attacker could exploit some of these vulnerabilities to take control of an affected...

Mitsubishi Electric Air Conditioning System

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: Multiple Air Conditioning Systems Vulnerability: Incorrect Implementation of Authentication Algorithm 2. RISK EVALUATION An attacker could exploit this vulnerability by impersonating...

Intel® FPGA OPAE Driver Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00440.html...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. This can occur when used with untrusted input, due to unsafe PAC file handling. In order to exploit this vulnerability in practice, this either requires an attacker on your local network, a specific vulnerable...

SUSE: Security Advisory (SUSE-SU-2020:2901-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-0393

In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for...

Integer overflow

In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for...