965 matches found
DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
The dsgvoaiowritelog AJAX action of the plugin did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard wp-admin/admin.php?page=dsgvoaiofree-show-log. This could allow unauthenticated attackers to gain unauthorised access by...
Arbitrary Code Injection
Overview In xmlhttprequest-ssl before 1.6.2 when requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run. Recommendation Upgrade to version 1.6.2 or later References CVE GitHub Advisory...
1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2798 more potentially affected by CVE-2020-28502 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)
xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2020-28502 Source advisory: GHSA-H4J5-C7CJ-74XG...
317-project (0.0.0), 4pm-cli (>=0.0.1, <=0.0.5) +1883 more potentially affected by CVE-2020-28502 via xmlhttprequest (>=1.2.2, <=1.6.0)
xmlhttprequest NPM version =1.2.2, =0.0.1, =0.1.16-master.20181116180810, =0.1.0, =1.1.1, =0.0.4, =1.0.399-main, =0.1.0, =0.1.2, =0.1.3 - @flexcodelabs/input 0.1.1 and more Source cves: CVE-2020-28502 Source advisory: GHSA-H4J5-C7CJ-74XG...
317-project (0.0.0), 4pm-cli (>=0.0.1, <=0.0.5) +1883 more potentially affected by CVE-2020-28502 via xmlhttprequest (>=1.2.2, <=1.6.0)
xmlhttprequest NPM version =1.2.2, =0.0.1, =0.1.16-master.20181116180810, =0.1.0, =1.1.1, =0.0.4, =1.0.399-main, =0.1.0, =0.1.2, =0.1.3 - @flexcodelabs/input 0.1.1 and more Source cves: CVE-2020-28502 Source advisory: OSV:GHSA-H4J5-C7CJ-74XG...
GHSA-H4J5-C7CJ-74XG xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2798 more potentially affected by CVE-2020-28502 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)
xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2020-28502 Source advisory: OSV:GHSA-H4J5-C7CJ-74XG...
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...
GetSimple CMS Custom JS 0.1 CSRF / XSS / Code Execution
Exploit Title: GetSimple CMS Custom JS v0.1 - CSRF to XSS to RCE Exploit Author: Bobby Cooke boku & Abhishek Joshi Date: April 30th, 2021 Vendor Homepage: http://get-simple.info Software Link: http://get-simple.info/download/ & http://get-simple.info/extend/plugin/custom-js/1267/ Vendor: 4Enzo...
Certificate Validation Bypass
xmlhttprequest-ssl is vulnerable to certificate validation bypass. The vulnerability exists because rejectUnauthorized is set to false by default, leading to bypass of certificate validation in the https.request function of Node.js...
CVE-2021-31597
A flaw was found in xmlhttprequest-ssl for Node.js. SSL certificate validation is disabled by default, due to rejectUnauthorized when the property exists but is undefined being considered to be false within the https.request function of Node.js thus, no certificate is ever rejected. The highest...
CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
AZL-45213 CVE-2021-31597 affecting package js-jquery 3.5.0-4
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
Input validation
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
UBUNTU-CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
1tp (>=0.0.1, <=0.11.2), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +2798 more potentially affected by CVE-2021-31597 via xmlhttprequest-ssl (>=1.5.1, <=1.5.5)
xmlhttprequest-ssl NPM version =1.5.1, =0.0.1, =1.0.2, =4.11.25, =0.1.3, =0.0.15, =8.25.29, =1.0.0, =0.0.4, =1.0.9, =0.2.9-dev-10, =0.13.0-alkemio, =0.17.0-alkemio-1 and more Source cves: CVE-2021-31597 Source advisory: MEND:CVE-2021-31597...
CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...
CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...