CVE-2020-28502

CVE-2020-28502 node-XMLHttpRequest RCE NVD 描述 这影响包 xmlhttprequest 1.7.0 之前的所有版本；以及包 xmlhttprequest-ssl 的所有版本。当请求同步发送时（即 xhr.open 中的 async=False），恶意用户输入流入 xhr.send 可能导致任意代码被注入并执行。 演示 设置 1. 从 Dockerfile 构建镜像 root@kitploit: $ docker build -t cve-2020-28502 . 2. 在新容器中运行 node app.js root@kitploit: $...

CLSA-2026-1785204344 TuxCare security update for xmlhttprequest-ssl (11 CVEs)

TuxCare rebuilt xmlhttprequest-ssl to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...

CLSA-2026-1772064638 TuxCare security update for xmlhttprequest-ssl (3 CVEs)

TuxCare rebuilt xmlhttprequest-ssl to address 3 CVEs. Fixed in 1.5.5-tuxcare.1...

EUVD-2021-0980

Malware in sbrugna...

Security Bulletin: A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-29469 DESCRIPTION: Node Redis redis module for Node.js is vulnerable to a denial of service, caused by a regular expression denial of service flaw in...

Security Bulletin: A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js xmlhttprequest-ssl module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2020-28502 DESCRIPTION: Node.js xmlhttprequest and xmlhttprequest-ssl modules could allow a remote attacker to execute arbitrary code on the system, caused ...

GHSA-72MH-269X-7MH5 Improper Certificate Validation in xmlhttprequest-ssl

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2802 more potentially affected by CVE-2021-31597 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)

xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2021-31597 Source advisory: OSV:GHSA-72MH-269X-7MH5...

Improper Certificate Validation in xmlhttprequest-ssl

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

Arbitrary Code Injection

Overview In xmlhttprequest-ssl before 1.6.2 when requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run. Recommendation Upgrade to version 1.6.2 or later References CVE GitHub Advisory...

xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

GHSA-H4J5-C7CJ-74XG xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2802 more potentially affected by CVE-2020-28502 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)

xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2020-28502 Source advisory: OSV:GHSA-H4J5-C7CJ-74XG...

Certificate Validation Bypass

xmlhttprequest-ssl is vulnerable to certificate validation bypass. The vulnerability exists because rejectUnauthorized is set to false by default, leading to bypass of certificate validation in the https.request function of Node.js...

CVE-2021-31597

A flaw was found in xmlhttprequest-ssl for Node.js. SSL certificate validation is disabled by default, due to rejectUnauthorized when the property exists but is undefined being considered to be false within the https.request function of Node.js thus, no certificate is ever rejected. The highest...

CVE-2021-31597

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

CVE-2021-31597

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

AZL-45213 CVE-2021-31597 affecting package js-jquery 3.5.0-4

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

Input validation

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

UBUNTU-CVE-2021-31597

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...