An information disclosure vulnerability exists in Rocket.Chat

A cleartext storage of sensitive information exists in Rocket.Chat

The llhttp parser

The llhttp parser

The llhttp parser

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.