Remote Memory Disclosure in bittorrent-dht

Versions of bittorrent-dht prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory. There are two mitigating factors here, that slightly reduce...

GHSA-77G4-36JP-5V3M Remote Memory Disclosure in bittorrent-dht

Versions of bittorrent-dht prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory. There are two mitigating factors here, that slightly reduce...

Node.js third-party modules: [arpping] Remote Code Execution

I would like to report RCE in arpping It allows to execute arbitrary commands on the victim's PC Module module name: arpping version: 2.0.0 npm page: https://www.npmjs.com/package/arpping Module Description Discover and search for internet-connected devices locally using ping and arp Module Stats...

@w3sec/goof (1.1.0), door (>=0.0.5, <=0.0.6) +5 more potentially affected by CVE-2014-3744 via st (>=0.0.12, <=0.2.4)

st NPM version =0.0.12, =0.0.5, =1.0.0, =0.0.0, =0.0.0-a10, =0.1.0, =0.0.1, =0.0.12 Source cves: CVE-2014-3744 Source advisory: OSV:GHSA-69RR-WVH9-6C4Q...

group-lunches (>=0.0.2, <=0.0.10), lets-chat-ldap (>=0.1.0, <=0.4.0) +5 more potentially affected by CVE-2015-7294 via ldapauth-fork (2.2.19)

ldapauth-fork NPM version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on ldapauth-fork and may be impacted: - group-lunches =0.0.2, =0.1.0, =0.0.2, =0.1.0, =0.0.0, =0.0.1 Source cves: CVE-2015-7294 Source advisory: OSV:GHSA-82MG-X548-GQ3J...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js modules

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains vulnerable versions of Node.js modules. Vulnerability Details CVEID: CVE-2019-15138 DESCRIPTION: Node.js html-pdf module could allow a remote attacker to obtain sensitive information, caused by improper input validation. By sending ...

Oracle Linux 8 : nodejs:12 (ELSA-2020-0598)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0598 advisory. nodejs 1:12.16.1-1 - Resolves: RHBZ1800393, RHBZ1800394, RHBZ1800380 - Rebase to 12.16.1 nodejs-nodemon nodejs-packaging Tenable has extracted the...

Node.js third-party modules: [i18next] Prototype pollution attack

I would like to report a prototype pollution vulnerability in i18next. It allows to modify the prototype of a base object, which may result in DoS, XSS, RCE, etc. depending on the way the library is used. Module module name: i18next version: 19.7.0 npm page: https://www.npmjs.com/package/i18next...

Node.js third-party modules: [bl] Uninitialized memory exposure via negative .consume()

Module module name: bl version: 4.0.2 npm page: https://www.npmjs.com/package/bl Module Description A Node.js Buffer list collector, reader and streamer thingy. Module Stats 8 660 595 weekly downloads Vulnerability Vulnerability Description If user input even typed ends up in consume argument and...

Node.js Express Fileupload Remote Code Execution (CVE-2020-7699)

A remote code execution vulnerability exists in Node.js express-fileupload package. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Security Bulletin: IBM Cloud Private is vulnerable to multiple node.js vulnerabilities (CVE-2020-11080, CVE-2020-10531, CVE-2020-8172, CVE-2020-8174)

Summary IBM Cloud Private is vulnerable to multiple node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-11080 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which is limited to 32 settings by default. By sending overly large...

in imsobear/node-browser

Overview node-browser is a wrapper webdriver by Node.js, this package is vulnerable to Man in the Middle MitM attacks due to downloading resources over an insecure protocol. Without a secure connection, it is possible for an attacker to intercept this connection and alter the packages received. I...

Path Traversal in marcbachmann/node-html-pdf

Overview html-pdf is a Html to pdf converter in Node.js, this package is vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input...

Node.js third-party modules: [supermixer] Prototype pollution

I would like to report a Prototype pollution in supermixer, It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation. Module module name: supermixer version: 1.0.3 npm page: https://www.npmjs.com/package/supermixer Module Descriptio...

Prototype Pollution

Overview safetydance is an Exception safety in node.js Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const safetydance = require'safetydance'; safetydance.set, 'proto.polluted', true; console.logpolluted; //true Details Prototype Pollution is a...

3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1598 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)

grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: SNYK:JS-GRPC-598671...

Security Bulletin: Netcool Operations Insight - Cloud Native Event Analytics is affected by a International Components for Unicode (ICU) for C/C++ vulnerability (CVE-2020-10531)

Summary Netcool Operations Insight - Cloud Native Event Analytics has addressed the following vulnerability in International Components for Unicode ICU for C/C++ Vulnerability Details CVEID: CVE-2020-11080 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2...

Oracle Linux 8 : nodejs:10 (ELSA-2020-2848)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2848 advisory. - Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531 Tenable has extracted the preceding description block directly from the Oracle Linux security...

[SECURITY] Fedora 32 Update: nodejs-12.18.3-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 31 Update: nodejs-12.18.3-1.fc31

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...