9 matches found
EUVD-2019-0221
Malware in sbrugna...
1tp (>=0.0.1, <=0.11.2), @chengkang/wildfire (>=0.0.1, <=0.0.4) +262 more potentially affected by CVE-2016-10536 via engine.io-client (>=1.6.4, <=1.6.8)
engine.io-client NPM version =1.6.4, =0.0.1, =0.0.1, =1.8.4, =1.0.0, =1.0.30, =0.1.0, =2.0.0-beta.1, =1.0.0, =0.0.1, =0.3.2, =0.3.0, =2.0.1, =1.7.0, =1.7.1 and more Source cves: CVE-2016-10536 Source advisory: OSV:GHSA-4R4M-HJWJ-43P8...
Insecure Defaults Allow MITM Over TLS in engine.io-client
Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, such as undefine...
GHSA-4R4M-HJWJ-43P8 Insecure Defaults Allow MITM Over TLS in engine.io-client
Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates to false, such as undefine...
CVE-2016-10536
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates ...
CVE-2016-10536
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates ...
Cross site scripting
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates ...
CVE-2016-10536
The CVE-2016-10536 issue affects engine.io-client (Socket.IO) prior to 1.6.9, where the client passes a settings object containing rejectUnauthorized; if not explicitly set, it can be passed as null, disabling certificate verification and exposing users to Man-in-the-Middle attacks. This behavior...
CVE-2016-10536
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the rejectUnauthorized setting. If the value is something that evaluates ...