9056 matches found
npm pg-native 代码问题漏洞
npm pg-native is a high-performance native binding between node.js and PostgreSQL from US-based npm, using a simple API via libpq. A code issue vulnerability exists in pg-native that stems from the plugin's susceptibility to a denial of service DoS when it attempts to convert the second parameter...
@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29247 via electron (>=17.0.0, <=17.1.2)
electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...
Security Bulletin: IBM Sterling Control Center is vulnerable to server-side request forgery due to Node.js axios module (CVE-2020-28168)
Summary Node.js axios module is used by IBM Sterling Control Center. A server-side request forgery vulnerability in Node.js axios module has been addressed. Vulnerability Details CVEID: CVE-2020-28168 DESCRIPTION: Node.js axios module is vulnerable to server-side request forgery, caused by improp...
Internet Bug Bounty: Undici ProxyAgent vulnerable to MITM
Full GitHub advisory summarizing the issue is here: https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 The original Node.js HackerOne report is here: https://hackerone.com/bugs?reportid=1583680 This was fixed & disclosed in Undici v5.5.1. This primarily affects Undici, a...
CVE-2022-29244
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
CVE-2022-29244
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
Code injection
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
CVE-2022-29244
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
CVE-2022-29244
CVE-2022-29244: npm pack/publish in a workspace may publish files excluded by root .gitignore/.npmignore. Affected: npm v7.9.0 and v7.13.0; patched in npm v8.11.0. Node.js v16.15.1, v17.19.1, v18.3.0 include the patched npm. Remediation: upgrade npm to the latest (npm i -g npm@latest).
CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...
nodejs-json-schema: Prototype pollution vulnerability
The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...
Moderate: Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Tutorial: How to Build Your First Node.js gRPC API
Compared to other API technologies like REST and GraphQL, gRPC is lightweight and exceptionally robust, thanks in large part to its use of protobufs. Interested in exploring how to build your own API? Read on to see how easy it is to do so with Node.js and gRPC...
OS Command Injection in proctree
OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function...
Command injection in google-it
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...
GHSA-7XHV-MPJW-422F Command injection in google-it
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...
OS Command injection in ssl-utils
OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest and the createCert functions...
GHSA-552J-PV39-F3JF OS Command injection in ssl-utils
OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest and the createCert functions...