13231 matches found
CVE-2022-31089
CVE-2022-31089 affects Parse Server (Node.js backend). The vulnerability arises from improper handling of certain invalid file requests, which can crash the server. Impact: availability can be high for a single instance, lower for clustered setups. The issue has been fixed in versions 4.10.12 and...
[SECURITY] [DSA 5170-1] nodejs security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5170-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 27, 2022 https://www.debian.org/security/faq -...
Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 & IBM Integration Bus (CVE-2020-7608)
Summary IBM App Connect Enterprise ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2020-7608 DESCRIPTION: Node.js yargs-parser module could allow a remote attacker to execute arbitrary cod...
CVE-2022-31089: Use of Incorrectly-Resolved Name or Reference
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability...
Security Bulletin: A Vulnerability in Redis Node.js module affecting Watson Knowledge Catalog for IBM Cloud Pak for Data (CVE-2021-29469)
Summary Redis Node.js module is vulnerable to a DOS that is impacting Watson Knowledge Catalog for IBM Cloud Pak for Data. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-29469 DESCRIPTION: Node Redis redis module for Node.js is vulnerable to a denial of service, caus...
nodejs:12 bug fix and enhancement update
An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...
OpenSSL update assessment, and Node.js project plans
OpenSSL update assessment, and Node.js project plans By Rafael Gonzaga, Jun 21, 2022 Summary The vulnerabilities in the OpenSSL Security releases of Jun 21 2022 do not affect any active Node.js release lines. Analysis Our assessment of the security advisory is: The crehash script allows command...
OpenSSL update assessment, and Node.js project plans
OpenSSL update assessment, and Node.js project plans Summary The vulnerabilities in the OpenSSL Security releases of Jun 21 2022 do not affect any active Node.js release lines. Analysis Our assessment of the security advisory is: The crehash script allows command injection CVE-2022-2068 Node.js...
MAL-2022-4903 Malicious code in nodejs-docs-samples-iot-mqtt-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a02c1e75441fabe4bcc6557ef33ce2bba5bdb671f2147161ddf0d05a90809ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4907 Malicious code in nodejs_net_server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c38544243e809d4f6d82a87abad44436a676a9ffc748c974ec1657ce0c99360a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4906 Malicious code in nodejs-gcloud-pubsub-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40eb63d0a4ed52650bf16d9a4d3a4cc2a9e305ba71dadfa7f7276be2f36ab743 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2022
Summary In addition to many updates of open source packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.2-IF011 and 21.0.3-IF009. Vulnerability Details CVEID:CVE-2021-44906 DESCRIPTION: Node.js Minimist module could allow a remote attacker...
Got allows a redirect to a UNIX socket
The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket...
GHSA-PFRX-2Q88-QQ97 Got allows a redirect to a UNIX socket
The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket...
CVE-2022-33987
The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...
CVE-2022-33987
The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...
Design/Logic Flaw
The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...
CVE-2022-33987
The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...
CVE-2022-33987
CVE-2022-33987 affects the Node.js got package. The vulnerability allows a redirect to a UNIX socket due to how redirects are handled. IBM/related advisories confirm the issue and that fixes are in got v12.1.0 and v11.8.5. Remediation: upgrade to 12.1.0+ (or 11.8.5+). Base scoring shown as MEDIUM...
