456 matches found
Arbitrary Code Execution
Overview swig-templates is an A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig. Affected versions of this package are vulnerable to Arbitrary Code Execution via the renderFile method. Note: The following conditions are required to...
DEBIAN-CVE-2021-35065
The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular expression...
nodejs: DNS rebinding in inspect via invalid octal IP address
A flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code...
The vulnerability of the --inspect parameter implementation in Node.js’s object manipulation tools allows attackers to execute arbitrary code.
The vulnerability of the --inspect parameter in the Node.js object manipulation tool is related to errors during the conversion of the octal IP address. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a...
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding
A vulnerability was found in NodeJS due to the llhttp parser in the HTTP module incorrectly handling multi-line Transfer-Encoding headers. This issue can lead to HTTP Request Smuggling HRS. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle...
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding
A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This issue can lead to HTTP Request Smuggling HRS, causing web cache poisoning, and conducting XSS attacks...
properties-reader 安全漏洞
properties-reader is a Node.js property reader compatible with ini files by Steve King, a personal developer. A security vulnerability exists in properties-reader prior to version 2.2.0, which stems from the package's susceptibility to prototype contamination, and which can be exploited by an...
ffmpeg-sdk 命令注入漏洞
ffmpeg-sdk is a ffmpeg wrapper for nodejs by the individual developer Shajan Jacob in India. A security vulnerability exists in ffmpeg-sdk, which stems from the vulnerability of index.js to command injection attacks...
The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
...
Node.js 安全漏洞
Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 16.5.4 and versions prior to 17.1.3 in the 17.x series, which stems from the fact that an incorrectly formatted MKV file may cause the file type detector to fall into an...
PT-2022-23214
Name of the Vulnerable Software and Affected Versions Apache SkyWalking NodeJS Agent versions prior to 0.5.1 Description The issue causes NodeJS services with the Apache SkyWalking NodeJS Agent installed to become unavailable when the OAP is unhealthy and the NodeJS agent cannot establish a...
PT-2022-10388
Name of the Vulnerable Software and Affected Versions glob-parent versions prior to 6.0.1 Description The issue allows ReDoS regular expression denial of service attacks against the enclosure regular expression in the glob-parent package for Node.js. Recommendations For versions prior to 6.0.1,...
The vulnerability of the WHATWG Fetch API interface for Node.js, related to errors in cookie handling, allows attackers to gain unauthorized access to protected information.
The vulnerability of the WHATWG Fetch API interface for Node.js’ cross-fetching mechanism is related to errors in cookie handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
The vulnerability of the providers.dll library in the Node.js software platform, related to HTTP request processing flaws, allows attackers to execute arbitrary code.
The vulnerability of the providers.dll library in the Node.js software platform is related to an uncontrolled search path during the loading of DLL libraries. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ALPINE-CVE-2022-32215
The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...
AZL-41051 CVE-2022-32213 affecting package rust for versions less than 1.75.0-1
The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling HRS...
CVE-2022-32222
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3...
got 安全漏洞
got is a user-friendly and powerful HTTP request library for Node.js. A security vulnerability exists in versions of got prior to 12.1.0 that originates from allowing redirection to UNIX sockets...
nodejs: Improper handling of URI Subject Alternative Names
A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...