454 matches found
The vulnerability of the console-io command shell in Node.js, related to authentication process flaws, allows attackers to execute arbitrary code.
The vulnerability of the console-io command shell for Node.js is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by connecting to the console using websocket...
dns-sync Command Injection Vulnerability
dns-sync is a library used in Node.js that allows to resolve hostnames in a synchronized way. A security vulnerability exists in dns-sync. An attacker can exploit this vulnerability to inject commands with untrusted user input...
Augustine Path Traversal Vulnerability
augustine is a static HTTP server used in Node.js. A path traversal vulnerability exists in augustine, which stems from the program's lack of url validation. The vulnerability can be exploited by sending a specially crafted GET request to read the contents of an arbitrary file with a known path...
Node.js Denial of Service Vulnerability (CNVD-2018-11811)
Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...
CVE-2016-10623
macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...
DEBIAN-CVE-2016-10539
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...
Joyent Node.js atob Denial of Service Vulnerability
Joyent Node.js is the United States Joyent a set of web applications built on top of Google V8 JavaScript engine platform. atob is one of the use of Buffer to simulate the browser ATOB functionality of the module . A security vulnerability exists in atob 2.0.3 and earlier on Joyent Node.js 4.x an...
CVE-2016-10590
cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an attacker controlled zip file if the attacker i...
Joyent Node.js ssri module denial of service vulnerability
Joyent Node.js is a set of Joyent's web application platform built on top of Google's V8 JavaScript engine. ssri module is one of the modules used for parsing, manipulating, serializing, and verifying the integrity of sub-resources . A security vulnerability exists in the index.js file in the...
AZL-32178 CVE-2017-18214 affecting package reaper for versions less than 3.1.1-10
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...
UBUNTU-CVE-2018-7651
index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string...
UBUNTU-CVE-2017-15897
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc0x100, "This is not correctly encoded", "hex";' The buffer implementation was updated such that the buffer will...
GHSA-HWCF-PP87-7X6P mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...
nodejs ejs cross-site scripting vulnerability
nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A cross-site scripting vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.5. A remote attacker can exploit the vulnerability to inject code...
nodejs ejs remote code execution vulnerability
nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A remote code execution vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.3, which stems from weak input validation. A remote attacker could...
Node.js tough-cookie module denial of service vulnerability
Node.js is a JavaScript runtime environment based on the Chrome V8 engine. A security vulnerability in the Node.js tough-cookie module's handling of HTTP requests using a special COOKIE allows remote attackers to exploit the vulnerability to submit specially crafted requests that can crash an...
DEBIAN-CVE-2017-15010
A ReDoS regular expression denial of service flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU...
UBUNTU-CVE-2017-15010
A ReDoS regular expression denial of service flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU...
Haraka Remote Command Execution Vulnerability
Haraka is written in Node.js with a modular plug-in structure of the open source SMTP server , in the high-traffic site has a very good application , serving thousands of services per second and send thousands of messages . Haraka suffers from a remote command execution vulnerability. An attacker...