Socketio Engineio Resource Management Error Vulnerability

Socketio Engineio is a Javascript-based real-time engine for bi-directional communication between browsers and devices from the Socketio community. A security vulnerability exists in Socketio Engine.IO before 4.0.0, which can be exploited by an attacker to cause a denial of service resource...

Insecure Defaults

Overview socket.io is a node.js realtime framework server. Affected versions of this package are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Remediation Upgrade socket.io to version 2.4.0 or higher. References - GitHub Issue - HackerOne...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

NodeBB Elevation of Privilege Vulnerability

NodeBB is a forum system built using Node.js a web application platform built on top of Google's V8 JavaScript engine by the Design Create Play team. A security vulnerability exists in the authentication logic in NodeBB versions 1.12.2 and later fixed in version 1.14.3. An attacker can exploit th...