wedosoftware / customerwebstore Goto Github PK

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The Faye::WebSocket::Client class uses the EM::Connection#start_tls method in EventMachine to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any wss: connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading faye-websocket to v0.11.0 is recommended.

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/178067

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/158831

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/212296

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/205848

This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/187733

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/207695

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/207145

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Read more at Debricked: https://app.debricked.com/en/service/vulnerability/219853