Node.js Multiple Vulnerabilities (August 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.5 or 14.17.5 or 16.6.2. It is, therefore, affected by multiple vulnerabilities including the following: - A remote command execution vulnerability exists in Node.js due to insufficient validation of untypical characters in doma...

Node.js Multiple Vulnerabilities (October 12th 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.7, 14.18.1 or 16.11.1. It is, therefore, affected by multiple HTTP smuggling vulnerabilities. An unauthenticated, remote attack could exploit these to bypass security controls, gain unauthorized access to sensitive data and...

Node.js Multiple Vulnerabilities (August 31st 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.6 or 14.17.6. It is, therefore, affected by multiple remote code execution vulnerabilities in various components due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this to bypass...

FreeBSD : Node.js -- October 2021 Security Releases (a9c5e89d-2d15-11ec-8363-0022489ad614)

Node.js reports : HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. HTTP Request Smuggling when parsing the body MediumCVE-2021-22960 The...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Summary IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities with details below Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling...

CVE-2021-22960

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

CVE-2021-22959

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an attacker can use this flaw to inject...

GHSA-MC7W-4CJF-C973 OS Command Injection in node-opencv

utils/find-opencv.js in node-opencv aka OpenCV bindings for Node.js prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands...

@finsemble/finsemble-electron-adapter (>=5.4.0, <=6.0.0), @innomind/studio (>=2.5.16, <=2.6.38) +19 more potentially affected by CVE-2021-39184 via electron (>=11.0.0, <=11.4.9)

electron NPM version =11.0.0, =5.4.0, =2.5.16, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.18.1, =0.32.0-alpha.47, =0.3.280, =1.0.0, =0.3.0, =4.0.1, =2.6.30, =2.6.42 - katex-screenshot 1.4.1 and more Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

@domoskanonos/nidoca-pwa (>=1.0.1, <=1.0.2), @finsemble/finsemble-electron-adapter (>=6.1.0-beta.20210707, <=6.2.1) +9 more potentially affected by CVE-2021-39184 via electron (>=13.0.1, <=13.2.3)

electron NPM version =13.0.1, =1.0.1, =6.1.0-beta.20210707, =0.26.3, =0.0.8, =0.0.1, =3.0.2, =1.3.17, =0.0.7, =2.0.29, =3.11.4, =5.4.2 - simple-git-gui 3.7.14 Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11 & v12 (CVE-2021-22930)

Summary IBM App Connect Enterprise v11 & v12 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions,...

October 12th 2021 Security Releases

October 12th 2021 Security Releases Update 12-Oct-2021 Security releases available Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues. HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a...

Node.js -- October 2021 Security Releases

Node.js reports: HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. HTTP Request Smuggling when parsing the body MediumCVE-2021-22960 The...

Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757

Summary IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution via CVE-2021-3757. This only affects App Connect Designers Vulnerability Details CVEID: CVE-2021-3757 DESCRIPTION: Node.js immer module could allow a remote attacker to execute arbitrary code on t...

Node.js 12.x < 12.22.4, 14.x < 14.17.4, 16.x < 16.6.0 Use After Free Vulnerability - Mac OS X

Node.js is prone to a use after free vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Node.js 12.x < 12.22.4, 14.x < 14.17.4, 16.x < 16.6.0 Use After Free Vulnerability - Windows

Node.js is prone to a use after free vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescriptio...

Security Bulletin: Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251, CVE-2020-8277)

Summary Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities. Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attack...

DEBIAN-CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...