CVE-2021-21388

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version = 5.6.4. If you cannot...

CVE-2021-21388

CVE-2021-21388 affects the systeminformation Node.js package (pre-5.6.4). It describes a command-injection flaw in how service parameters are handled (si.inetLatency, si.inetChecksite, si.services, si.processLoad, etc.). The root cause is insufficient validation of input parameters; upgrading to ...

CVE-2021-21388 Command Injection Vulnerability in systeminformation

systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version = 5.6.4. If you cannot...

Security Bulletin: IBM App Connect Enterprise Certified Container flows may be vulnerable to spoofing attacks (CVE-2020-26291)

Summary An App Connect Enterprise flow that uses the Jira connector may be vulnerable to a spoofing attack if the flow can be made to target a specially-crafted URL Vulnerability Details CVEID: CVE-2020-26291 DESCRIPTION: Node.js urijs module could allow a remote attacker to conduct spoofing...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to a denial of service attack through a DNS lookup that returns a large number of responses (CVE-2020-8277)

Summary An App Connect Enterprise flow could trigger a denial of service if made to resolve a DNS lookup for an endpoint that returns a large number of responses Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to...

Security Bulletin: IBM App Connect Enterprise Certified Container Designer Authoring components may be vulnerable to a denial of service attack (CVE-2020-28477)

Summary A Designer Authoring component in App Connect Enterprise Certified Container may be vulnerable to a denial of service vulnerability due to a prototype polution vulnerability in one of the UI's dependencies Vulnerability Details CVEID: CVE-2020-28477 DESCRIPTION: Node.js immer module is...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to multiple denial of service and HTTP request smuggling vulnerabilities

Summary App Connect Enterprise flows may be susceptible to denial of service attacks due to CVE-2020-1971 and CVE-2020-8265 in the Node.js runtime, and all components may be vulnerable to HTTP request smuggling due to CVE-2020-8287. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to a Server-Side Request Forgery vulnerability (CVE-2020-28168)

Summary If an App Connect flow calls a URL controlled by a malicious actor, and App Connect Enterprise is running in an environment with a proxy, the controller of the target URL can construct a response with a redirect that results in the proxy being bypassed Vulnerability Details CVEID:...

CVE-2021-21414

Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the @prisma/sdk package who are affected by this security vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable...

Remote code execution

Prisma is an open source ORM for Node.js & TypeScript. As of today, we are not aware of any Prisma users or external consumers of the @prisma/sdk package who are affected by this security vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable...

CVE-2021-21414

The CVE-2021-21414 entry concerns Prisma’s @prisma/sdk, specifically the getPackedPackage function, where untrusted input could lead to OS command injection and remote code execution. The vulnerability was identified across multiple records and is mitigated by patches in @prisma/sdk version 2.20....

Mail.ru: [geekbrains.ru] Node modules path disclosure due to lack of error handling

Full stack error trace at HTTP 404-error on nexus.geekbrains.ru discloses the full path of the Node.js module directory on the server...

Security Bulletin: Multiple vulnerabilities in Node.js affecting Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux

Summary Portions of Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i Modernization Tools, Java edition, and Rational Developer for AIX and Linux. Multiple Node.js vulnerabilities have been discovered that affect the Cordova platform...

Certificate Validation Bypass

xmlhttprequest-ssl is vulnerable to certificate validation bypass. The vulnerability exists because rejectUnauthorized is set to false by default, leading to bypass of certificate validation in the https.request function of Node.js...

[SECURITY] Fedora 34 Update: nodejs-14.16.1-1.fc34

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Security Bulletin: Vulnerabilities in Apache and Node.js affect IBM Spectrum Protect Plus

Summary Vulnerabilities in Apache and Node.js such as execution of arbitrary code on the system, cross -site scripting, and bypassing security restrictions, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-28458 DESCRIPTION: Node.js datatables.net module could allow a...

Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software

Summary Vulnerabilities detected in Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

CVE-2021-31597

A flaw was found in xmlhttprequest-ssl for Node.js. SSL certificate validation is disabled by default, due to rejectUnauthorized when the property exists but is undefined being considered to be false within the https.request function of Node.js thus, no certificate is ever rejected. The highest...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...