Security Bulletin: Public disclosed vulnerabilities from Node.js affect IBM Spectrum LSF Explorer, IBM Spectrum LSF Suite, and IBM Spectrum LSF Suite for HPA

Summary Public disclosed vulnerabilities from Node.js affect IBM Spectrum LSF Explorer, IBM Spectrum LSF Suite, and IBM Spectrum LSF Suite for HPA. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Oracle Linux 8 : nodejs:10 (ELSA-2021-0548)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0548 advisory. nodejs 1:10.23.1-1 - January Security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Rebase to 10.23.1 - Resolves...

nodejs:12 security update

nodejs 1:12.20.1-1 - Security rebase for January security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Resolves: RHBZ1916460, RHBZ1914786 - Resolves: RHBZ1914784, RHBZ1916396 nodejs-nodemon 2.0.3-1 - Resolves: RHBZ1921841, RHBZ1921843, RHBZ1921842 - Rebase ...

nodejs:10 security update

nodejs 1:10.23.1-1 - January Security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Rebase to 10.23.1 - Resolves: RHBZ1916461, RHBZ1914789 - Resolves: RHBZ1914783, RHBZ1916462, RHBZ1916395, RHBZ1916459 - Resolves: RHBZ1916691, RHBZ1916689, RHBZ1916388 - Remo...

Oracle Linux 8 : nodejs:14 (ELSA-2021-0551)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0551 advisory. nodejs 1:14.15.4-2 - Add patch for yarn crash - Resolves: RHBZ1916465 1:14.15.4-1 - Security rebase to 14.15.4 -...

CVE-2021-3189

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring...

CVE-2021-3189

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring...

Open redirect

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring...

CVE-2021-3189

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring...

CVE-2021-3189

CVE-2021-3189 affects the npm package slashify (version 1.0.0) for Node.js, which normalises routes but does not validate redirection targets. Exploitation involves open redirects (example: localhost:3000///example.com/ redirects to a different domain), enabling phishing-like redirects. Public ad...

Remote Code Execution (RCE)

Overview total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution RCE via set. PoC // To...

CVE-2021-27405

A ReDoS regular expression denial of service flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js...

Design/Logic Flaw

A ReDoS regular expression denial of service flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management. Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker coul...

Security Bulletin: A security vulnerability in Node.js y18n module affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js y18n module affects IBM Cloud Pak for Multicloud Management. Vulnerability Details CVEID: CVE-2020-7774 DESCRIPTION: Node.js y18n module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By...

Security Bulletin: A security vulnerability in Node.js ini module affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js ini module affects IBM Cloud Pak for Multicloud Management. Vulnerability Details CVEID: CVE-2020-7788 DESCRIPTION: Node.js ini module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By sendin...

Security Bulletin: A security vulnerability in Node.js xml-crypto module affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js xml-crypto module affects IBM Cloud Pak for Multicloud Management. Vulnerability Details Third Party Entry: 192357 DESCRIPTION: Node.js xml-crypto module security bypass CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: A security vulnerability in Node.js codemirror module affects IBM Cloud Pak for Multicloud Management.

Summary A security vulnerability in Node.js codemirror module affects IBM Cloud Pak for Multicloud Management. Vulnerability Details CVEID: CVE-2020-7760 DESCRIPTION: Node.js codemirror module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw. By...

CVE-2021-27405

A ReDoS regular expression denial of service flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js...

CVE-2021-27405

CVE-2021-27405 affects the Node.js package "@progfay/scrapbox-parser" before version 6.0.3 (also 7.0.2 in some advisories). The root cause is a Regular Expression Denial of Service (ReDoS) in DecorationNode, StrongNode and ExternalLinkNode that can be triggered by crafted input, causing high CPU ...