CVE-2013-7378

scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...

Command injection

scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...

CVE-2013-7378

scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...

CVE-2013-7378

CVE-2013-7378 affects hubot-scripts: the email.coffee script in hubot-scripts (Node.js) prior to version 2.4.4 allows remote command execution due to a command-injection flaw in hubot-scripts/package/src/scripts/email.coffee. Impact is high (remote attacker could run arbitrary commands). Affected...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA

Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA. IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA have addressed the applicable CVEs. Vulnerability Details Refer to the security bulletinss listed in the...

Node.js third-party modules: Server-Side Request Forgery (SSRF) in Ghost CMS

I would like to report about SSRF vulnerability in CMS Ghost blog It allows attacker able to send a crafted GET request from a vulnerable web application Module module name: ghost version: 3.5.2 npm page: https://www.npmjs.com/package/ghost website page https://ghost.org/ Module Description Ghost...

Joyent Node.js Input Validation Error Vulnerability

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

[SECURITY] Fedora 31 Update: nodejs-12.15.0-1.fc31

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Node.js third-party modules: [hangersteak] Web Server Directory Traversal via Crafted GET Request

I would like to report path traversal in hangersteak module. It allows an attacker to read system files via path traversal local/remote Module module name: hangersteak version: 0.2.4 latest npm page: https://www.npmjs.com/package/hangersteak Module Description Node web static files server with...

Node.js third-party modules: [sirloin] Web Server Directory Traversal via Crafted GET Request

I would like to report path traversal in Sirloin module. It allows an attacker to read system files via path traversal local/remote Module module name: Sirloin version: 0.15.0 latest release build npm page: https://www.npmjs.com/package/sirloin Module Description This high performance, extremely...

CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

DEBIAN-CVE-2019-15606

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...

CVE-2019-15604

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate...

CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

CVE-2019-15604

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate...

Design/Logic Flaw

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...

Input validation

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate...

UBUNTU-CVE-2019-15604

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate...

CVE-2019-15604

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate...

CVE-2019-15605

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...