Security Bulletin: A security vulnerability in Node.js pac-resolver module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js pac-resolver module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23406 DESCRIPTION: Node.js pac-resolver module could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe PAC file handling. ...

Critical Bug Reported in NPM Package With Millions of Downloads Weekly

A widely used NPM package called 'Pac-Resolver' for the JavaScript programming language has been remediated with a fix for a high-severity remote code execution vulnerability that could be abused to run malicious code inside Node.js applications whenever HTTP requests are sent. The flaw, tracked ...

GHSA-9J49-MFVP-VMHM Code Injection in pac-resolver

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

Code Injection in pac-resolver

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406

A flaw was found in nodejs-pac-resolver. A remote code execution can occur with untrusted input, due to unsafe PAC file handling. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Remote Code Execution

degenerator is vulnerable to remote code execution. The vulnerability exists due to unsafe PAC file handling...

CVE-2021-30966

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2, tvOS 15.2. User traffic might unexpectedly be leaked to a proxy server despite PAC configurations...

Code injection

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2, tvOS 15.2. User traffic might unexpectedly be leaked to a proxy server despite PAC configurations...

CVE-2021-30966

CVE-2021-30966 is a logic issue in CFNetwork Proxies that could cause user traffic to be leaked to a proxy server despite PAC configurations. Public details in Apple security updates show the issue affects macOS Monterey 12.1 (and related updates for other Apple platforms) and was addressed in Mo...

CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

Input validation

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406 Remote Code Execution (RCE)

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

CVE-2021-23406

Technical details about CVE-2021-23406 are not provided in the connected documents. Public details appear limited to the initial description. Monitor for updates from official advisories.

CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer...

pac-resolver 安全漏洞

pac-resolver is a function that generates an asynchronous parser from a PAC file. A security vulnerability exists in pac-resolver versions prior to 5.0.0 that stems from the application of insecure PAC file handling, which may occur when used with untrusted input...

FAQ: Citrix Secure Web and Proxy Support

This article answers the frequently asked questions on Secure Web and Web proxy support. For more information about Secure Web and proxy support, refer to Citrix Documentation - Citrix Secure Web. The support for PAC file inMDX application is removed as of September 2021. This means Citrix has...

Schneider Modicon PAC Controller Has Industrial Control Device Vulnerability

The Schneider Electric M340 is mid-range PAC industrial process and infrastructure control. The Schneider Electric M340 has an industrial control device vulnerability that can be exploited by an attacker to remotely obtain a backdoor password, which can be used to connect to a password-protected...

Authorization Bypass Vulnerability in Schneider Electric Modicon PAC M580, M340

Schneider Electric SA is a global electrical company headquartered in France. An authorization bypass vulnerability exists in the Schneider Electric Modicon PAC M580, M340, which can be exploited by an attacker to cause a denial of service...

CISA Releases Security Advisory for Philips Vue PAC Products

CISA has released an Industrial Controls Systems ICS Medical Advisory detailing multiple vulnerabilities in multiple Philips Clinical Collaboration Platform Portal officially registered as Vue PACS products. An attacker could exploit some of these vulnerabilities to take control of an affected...

Mitsubishi Electric Air Conditioning System

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: Multiple Air Conditioning Systems Vulnerability: Incorrect Implementation of Authentication Algorithm 2. RISK EVALUATION An attacker could exploit this vulnerability by impersonating...