NestJS Proxy 信息泄露漏洞

NestJS Proxy is a Finastra open source NestJS module for decorating and proxying calls. An information disclosure vulnerability exists in NestJS Proxy versions prior to 0.7.0 that stems from the nestjs-proxy library's inability to prevent the forwarding of sensitive cookies e.g., session cookies ...

PT-2022-20505

Name of the Vulnerable Software and Affected Versions @finastra/nestjs-proxy versions prior to 0.7.0 @ffdc/nestjs-proxy affected versions not specified Description The nestjs-proxy library did not have a way to block sensitive cookies, such as session cookies, from being forwarded to backend...

@gleb216/fn.nestjs.core.modules (>=0.0.87, <=0.0.93), @haulsuite/livehaul-sdk (>=0.0.1, <=1.0.0) +17 more potentially affected by CVE-2023-26108 via @nestjs/core (>=9.0.0, <=9.0.4)

@nestjs/core NPM version =9.0.0, =0.0.87, =0.0.1, =0.1.0, =9.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.8, =4.49.1-test.3, =0.6.0, =0.0.13, =0.1.7, =0.4.0 - nestjs-eclih 0.0.15 and more Source cves: CVE-2023-26108 Source advisory: SNYK:JS-NESTJSCORE-2869127...

Information Exposure

Overview @nestjs/core is a Nest - modern, fast, powerful node.js web framework @core Affected versions of this package are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a...

@glossgenius/eslint-config (>=1.0.2, <=1.0.7), @halonext/nestjs-express-cassandra (>=7.0.0, <=7.1.0) +7 more potentially affected by CVE-2021-26707 via merge-deep (>=3.0.0, <=3.0.2)

merge-deep NPM version =3.0.0, =1.0.2, =7.0.0, =5.2.0, =6.0.1, =0.0.1, =0.1.0-rc0, =0.0.11, =1.0.0, =1.2.4 Source cves: CVE-2021-26707 Source advisory: SNYK:JS-MERGEDEEP-1070277...