CVE-2021-31597

The CVE-2021-31597 entry concerns the xmlhttprequest-ssl package for Node.js before version 1.6.1, which disables SSL certificate validation by default because rejectUnauthorized is treated as false when undefined. This allows potential MITM-style exposure since certificates are not rejected. Aff...

CVE-2021-31597: Improper Certificate Validation

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected...

Dan DeFelippi node-XMLHttpRequest Trust Management Vulnerability

Dan DeFelippi node-XMLHttpRequest is Dan DeFelippi an open source application . Used to simulate the browser XMLHttpRequest object . A trust management issue vulnerability exists in Node.js xmlhttprequest-ssl package versions prior to 1.6.1, which stems from the fact that no certificate will be...

PT-2021-19437

Name of the Vulnerable Software and Affected Versions xmlhttprequest-ssl versions prior to 1.6.1 Description The issue concerns the disabling of SSL certificate validation by default in the xmlhttprequest-ssl package for Node.js. This occurs because the rejectUnauthorized property, when it exists...

CVE-2021-24167

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

CVE-2021-24167

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

Design/Logic Flaw

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

CVE-2021-24167 Web-Stat < 1.4.1 - API Key Disclosure

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

CVE-2021-24167

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

CVE-2021-24167: Exposure of Sensitive Information to an Unauthorized Actor

When visiting a site running Web-Stat 1.4.0, the "wtswebstatloadinit" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookupWPaccount...

PT-2021-15713

Name of the Vulnerable Software and Affected Versions: Web-Stat versions prior to 1.4.0 Description: The issue concerns the wts web stat load init function, which sends an XMLHttpRequest request to the "/ajax.htm?action=lookup WP account" endpoint. This function is used when visiting a site runni...

MyBB 1.8.25 Remote Command Execution

Exploit Title: MyBB 1.8.25 - Chained Remote Command Execution Exploit Author: SivertPL [email protected] Date: 19.03.2021 Description: Nested autourl Stored XSS - templateset second order SQL Injection leading to RCE through improper string interpolation in eval. Software Link:...

Arbitrary Code Execution

xmlhttprequest is vulnerable to arbitrary code execution. The vulnerability exists through the lack of encoding of data in the this.send function...

CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

DEBIAN-CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

UBUNTU-CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...

317-project (0.0.0), 4pm-cli (>=0.0.1, <=0.0.5) +1883 more potentially affected by CVE-2020-28502 via xmlhttprequest (>=1.2.2, <=1.6.0)

xmlhttprequest NPM version =1.2.2, =0.0.1, =0.1.16-master.20181116180810, =0.1.0, =1.1.1, =0.0.4, =1.0.399-main, =0.1.0, =0.1.2, =0.1.3 - @flexcodelabs/input 0.1.1 and more Source cves: CVE-2020-28502 Source advisory: MEND:CVE-2020-28502...

CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously async=False on xhr.open, malicious user input flowing into xhr.send could result in arbitrary code being injected and run...