7ghost (>=4.11.0, <=4.11.46), @agneta/platform (>=0.16.9, <=0.17.0) +68 more potentially affected by unknown CVE via express-brute (>=1.0.0, <=1.0.1)

express-brute NPM version =1.0.0, =4.11.0, =0.16.9, =0.0.2-publish-module-10a23dea78e8b2ead9b62883b97c62fe5e838b4d, =3.1.0-beta.9, =0.0.1, =1.0.0-0, =1.3.3, =1.0.0, =1.1.0, =3.41.6, =1.0.1, =1.1.42, =1.2.15 and more Source cves: unknown CVE Source advisory: OSV:GHSA-984P-XQ9M-4RJW...

GHSA-984P-XQ9M-4RJW Rate Limiting Bypass in express-brute

All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...

PT-2019-20032

Name of the Vulnerable Software and Affected Versions express-brute versions all Description The issue allows an attacker to bypass rate limiting, potentially executing requests without limitation, due to concurrent requests leading to race conditions that cause incorrect request counting...

express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison

Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the...

GHSA-C35V-QWQG-87JC express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison

Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the...

@blitzbank/dashboard (>=0.0.1, <=0.0.2), @coinmesh/lnd-adapter (>=0.0.1, <=0.2.12) +11 more potentially affected by unknown CVE via express-basic-auth (>=1.0.0, <=1.1.6)

express-basic-auth NPM version =1.0.0, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1, =1.0.0, =0.1.5, =1.0.0, =0.1.0, =2.0.0, =1.1.0, =1.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-C35V-QWQG-87JC...

PT-2019-20035

Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7 Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase t...

Duplicate Advisory: Privilege Escalation in express-cart

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr89-w7p6-pjmq. This link is maintained to preserve external references. Original Description Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so...

PT-2019-19995

Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.6 Description The issue allows normal users to escalate their privileges, enabling them to add new administrator users. Recommendations Update to version 1.1.6 or later...

Cross-site Scripting (XSS)

express-validator is vulnerable to cross-site scripting XSS. The vulnerability exists as it was possible to bypass the sanitize function as the toString function does not sanitize arrays...

Admin Express 1.2.5.485 - Folder Path Local SEH Alphanumeric Encoded Buffer Overflow

Admin Express 1.2.5.485 - Folder Path Local SEH Alphanumeric Encoded Buffer Overflow Title: Admin Express v1.2.5.485 'Folder Path' Local SEH Alphanumeric Encoded Buffer Overflow Date: May 6th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage:...

Admin Express 1.2.5.485 Buffer Overflow Exploit

Exploit for windows platform in category local exploits Title: Admin Express v1.2.5.485 Folder Path Local SEH Alphanumeric Encoded Buffer Overflow Date: May 6th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage: https://admin-express.en.softonic.com/ Software Link:...

Admin Express 1.2.5.485 - 'Folder Path' Local SEH Alphanumeric Encoded Buffer Overflow

Title: Admin Express v1.2.5.485 'Folder Path' Local SEH Alphanumeric Encoded Buffer Overflow Date: May 6th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage: https://admin-express.en.softonic.com/ Software Link: https://admin-express.en.softonic.com/download Version...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8.0.5.30 used by IBM Security SiteProtector System. IBM Security SiteProtector System has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-3139 DESCRIPTION: An unspecified vulnerability in...

The vulnerability of the Cisco Encrypted Traffic Analytics technology’s implementation in the Cisco IOS XE operating system allows a attacker to trigger a service failure.

The vulnerability of the Cisco Encrypted Traffic Analytics ETA implementation for the Cisco IOS XE operating system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by using specially crafted IP packets...

Timing Attack

Overview Versions of express-basic-auth prior to 1.2.0 are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing t...

Overstepping Access Vulnerability in China Postal Express App

CPSE APP is a 24-hour courier self-service courier software. An override access vulnerability exists in China Post Express & Easy APP. The attacker obtains other users' information by grabbing packets and intercepting modifications...

Rate Limiting Bypass

Overview All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting...

CVE-2019-1686 Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability

A vulnerability in the TCP flags inspection feature for access control lists ACLs on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect...

Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability

A vulnerability in the TCP flags inspection feature for access control lists ACLs on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect...