0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +1905 more potentially affected by CVE-2023-32695 via socket.io-parser (>=4.0.5, <=4.2.2)

socket.io-parser NPM version =4.0.5, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2023-32695 Source advisory: MEND:CVE-2023-32695...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2023-32695 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2023-32695 Source...

10cartsharing (>=1.0.0, <=1.0.3), 1api (>=0.0.1, <=0.0.2) +7935 more potentially affected by CVE-2023-32695 via socket.io-parser (>=2.2.2, <=3.3.0)

socket.io-parser NPM version =2.2.2, =1.0.0, =0.0.1, =0.0.1, =0.1.0, =1.0.2, =1.0.1, =2.16.1, =1.0.0-RC.1, =0.1.0, =1.0.0, =1.3.2 - 88slot-ap 1.0.0 and more Source cves: CVE-2023-32695 Source advisory: MEND:CVE-2023-32695...

CVE-2023-32695: Improper Input Validation

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2023-32695 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2023-32695 Source...

GHSA-CQMJ-92XF-R6R9 Insufficient validation when decoding a Socket.IO packet

Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. TypeError: Cannot convert object to primitive value at Socket.emit node:events:507:25 at .../nodemodules/socket.io/lib/socket.js:531:14 Patches A fix has been...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1118 more potentially affected by CVE-2023-32695 via socket.io-parser (>=3.1.1, <=3.3.0)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2023-32695 Source advisory: OSV:GHSA-CQMJ-92XF-R6R9...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +1905 more potentially affected by CVE-2023-32695 via socket.io-parser (>=4.0.5, <=4.2.2)

socket.io-parser NPM version =4.0.5, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2023-32695 Source advisory: OSV:GHSA-CQMJ-92XF-R6R9...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1118 more potentially affected by CVE-2023-32695 via socket.io-parser (>=3.1.1, <=3.3.0)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2023-32695 Source advisory: GHSA-CQMJ-92XF-R6R9...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2023-32695 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2023-32695 Source...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +1905 more potentially affected by CVE-2023-32695 via socket.io-parser (>=4.0.5, <=4.2.2)

socket.io-parser NPM version =4.0.5, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2023-32695 Source advisory: GHSA-CQMJ-92XF-R6R9...

Type Confusion

socket.io-parser is vulnerable to type confusion. It is possible to overwrite the placeholder object due to improper type validation of attachment parsing in the reconstructPacket function, which allows an attacker to place references to functions at arbitrary places in the resulting query object...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1118 more potentially affected by CVE-2022-2421 via socket.io-parser (>=3.1.1, <=3.3.0)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2022-2421 Source advisory: OSV:GHSA-QM95-PGCG-QQFQ...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2022-2421 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2022-2421 Source...

@asigna/stx-core-sdk (0.0.1), @casper124578/use-socket.io (>=2.1.0, <=4.1.0) +133 more potentially affected by CVE-2022-2421 via socket.io-parser (4.1.2)

socket.io-parser NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @asigna/stx-core-sdk 0.0.1 - @casper124578/use-socket.io =2.1.0, =31.0.0, =34.0.0, =34.0.0, =1.0.0-theia1.27.0, =1.0.0, =1.0.1,...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1118 more potentially affected by CVE-2022-2421 via socket.io-parser (>=3.1.1, <=3.3.0)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2022-2421 Source advisory: GHSA-QM95-PGCG-QQFQ...

socket.io (>=3.0.0-rc1, <=3.0.0-rc4), socket.io-client (>=3.0.0-rc1, <=3.0.0-rc4) potentially affected by CVE-2022-2421 via socket.io-parser (>=4.0.1-rc1, <=4.0.1-rc3)

socket.io-parser NPM version =4.0.1-rc1, =3.0.0-rc1, =3.0.0-rc1, =3.0.0-rc4 Source cves: CVE-2022-2421 Source advisory: GHSA-QM95-PGCG-QQFQ...

@asigna/stx-core-sdk (0.0.1), @casper124578/use-socket.io (>=2.1.0, <=4.1.0) +133 more potentially affected by CVE-2022-2421 via socket.io-parser (4.1.2)

socket.io-parser NPM version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @asigna/stx-core-sdk 0.0.1 - @casper124578/use-socket.io =2.1.0, =31.0.0, =34.0.0, =34.0.0, =1.0.0-theia1.27.0, =1.0.0, =1.0.1,...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2022-2421 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2022-2421 Source...

socket.io (>=3.0.0-rc1, <=3.0.0-rc4), socket.io-client (>=3.0.0-rc1, <=3.0.0-rc4) potentially affected by CVE-2022-2421 via socket.io-parser (>=4.0.1-rc1, <=4.0.1-rc3)

socket.io-parser NPM version =4.0.1-rc1, =3.0.0-rc1, =3.0.0-rc1, =3.0.0-rc4 Source cves: CVE-2022-2421 Source advisory: OSV:GHSA-QM95-PGCG-QQFQ...