Moment.js: Path traversal in moment.locale

A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...

Security Bulletin: Multiple vulnerabilities in moment.js affect IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-31129, CVE-2022-24785)

Summary There are multiple vulnerabilities in moment.js that are used by IBM Maximo Asset Management and the IBM Maximo Manage application in the IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficien...

SUSE CVE-2022-31129

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...

Security Bulletin: IBM App Connect Enterprise Certified Container flows that use scheduled event nodes may be vulnerable to denial of service due to [CVE-2023-22467]

Summary Node.js module moment.js Luxon is used by IBM App Connect Enterprise Certified Container in the scheduled event node. IBM App Connect Enterprise Certified Container IntegrationServer and DesignerAuthoring operands that run flows containing a scheduled event node may be vulnerable to denia...

Security Bulletin: Vulnerability in Moment.js affects IBM Process Mining . CVE-2022-24785

Summary There is a vulnerability in Moment.js that could allow a path traversal. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attack...

nodejs-moment: Regular expression denial of service

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...

[SECURITY] [DLA 3295-1] node-moment security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3295-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 31, 2023 https://wiki.debian.org/LTS -...

Ubuntu: Security Advisory (USN-4786-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Detection of Vulnerabilities in JavaScript Libraries

JavaScript is a popular programming language which is an integral component while developing interactive and dynamic web applications. It allows developers to create engaging and responsive user interfaces, handling complex web page elements, enhancing the overall functionality of the application...

Moment.js: Path traversal in moment.locale

A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage 5.3 security update and Bug Fix

An update for ceph, cephadm-ansible, ceph-iscsi, python-dataclasses, and python-werkzeug is now available for Red Hat Ceph Storage 5.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

RHEL 8 / 9 : Red Hat Ceph Storage 5.3 security update and Bug Fix (Moderate) (RHSA-2023:0076)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0076 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with...

mantis -- multiple vulnerabilities

Mantis 2.25.6 release reports: Security and maintenance release 0031086: Private issue summary disclosure CVE-2023-22476 0030772: Update bundled moment.js to 2.29.4 CVE-2022-31129 0030791: Allow adding relation type noopener/noreferrer to outgoing links...

Tenable Nessus Network Monitor < 5.11.0 Multiple Vulnerabilities (TNS-2019-08)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Tenable Nessus Network Monitor 5.11.0 - 6.1.1 Multiple Vulnerabilities (TNS-2022-28)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Tenable Nessus Network Monitor < 6.1.0 Multiple Vulnerabilities (TNS-2022-19)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[R1] Nessus Network Monitor Version 6.2.0 Fixes Multiple Vulnerabilities

R1 Nessus Network Monitor Version 6.2.0 Fixes Multiple Vulnerabilities Arnie Cabral Mon, 12/19/2022 - 10:28 Nessus Network Monitor leverages third-party software to help provide underlying functionality. Two of these third-party components moment.js, handlebars were found to contain...

moment: inefficient parsing algorithm resulting in DoS

A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service ReDoS attacks...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.1 release and security update

A minor version update from 7.11 to 7.11.1 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Security Bulletin: IBM Planning Analytics Workspace is affected by a vulnerability [CVE-2022-31129]

Summary IBM Planning Analytics Workspace is affected by a vulnerability. Moment.js is a library used to parse, validate, manipulate, and display dates and times in JavaScript. This vulnerability has been addressed. CVE-2022-31129 Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is...