Node.js third-party modules: [tianma-static] Stored xss on filename

I would like to report stored xss in tianma-static It allows anyone to execute arbitary javascript for doing anything. Module module name: tianma-static version: 1.0.4 npm page: https://www.npmjs.com/package/tianma-static Module Description Provide a static file service. Vulnerability Vulnerabili...

[SECURITY] Fedora 27 Update: nodejs-8.11.4-1.fc27

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

FreeBSD : node.js -- multiple vulnerabilities (0904e81f-a89d-11e8-afbb-bc5ff4f77b71)

Node.js reports : OpenSSL: Client DoS due to large DH parameter This fixes a potential denial of service DoS attack against client connections by a malicious server. During a TLS communication handshake, where both client and server agree to use a cipher-suite using DH or DHE Diffie-Hellman, in...

Node.js 10.x < 10.9.0 Unintentional Exposure of Uninitialized Memory Vulnerability - Mac OS X

Node.js is prone to an unintentional exposure of uninitialized memory. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Node.js < 10.9.0, < 8.11.4, < 6.14.4 OOB Write Vulnerability - Windows

Node.js is prone to an out-of-bounds write vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js";...

Node.js 10.x < 10.9.0 Unintentional Exposure of Uninitialized Memory Vulnerability - Windows

Node.js is prone to an unintentional exposure of uninitialized memory. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Node.js < 10.9.0, < 8.11.4, < 6.14.4 OOB Write Vulnerability - Mac OS X

Node.js is prone to an out-of-bounds write vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js";...

Syhunt Community Hybrid Scanner v6.2

Syhunt Community is a hybrid static and dynamic web application security scanner. Syhunt is able to scan any kind of application source code for potential security vulnerabilities, pinpointing the exact lines of the code that need to be patched. Or you can simply enter a start URL and get detaile...

@ftnk/electron-prebuilt-compile (1.7.3), @philipptrenz/photo-booth (>=1.0.1, <=1.0.6) +68 more potentially affected by CVE-2018-15685 via electron (>=1.7.0, <=1.7.13)

electron NPM version =1.7.0, =1.0.1, =1.0.0, =1.0.1, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.4.0-next.64347695, =0.2.0-next.0148a1fd, =0.2.0-next.0148a1fd, =0.2.0-next.29255833, =0.2.0-next.29255833, =0.2.0-next.0148a1fd, =0.2.1, =0.2.0-next.29255833, =0.4.0-next.ff386514 and more Source...

[SECURITY] Fedora 28 Update: nodejs-8.11.4-1.fc28

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Unspecified vulnerability in Joyent Node.js (CNVD-2019-42560)

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Node.js 10.9.0 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

nodejs: Unintentional exposure of uninitialized memory

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause Buffer.alloc to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Node.js 8.11.4 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Node.js third-party modules: [serve] XSS via HTML tag injection in directory lisiting page

I would like to report HTML injection in serve module. It allows malicious HTML tags injection and execution of arbitrary JS code Module module name: serve version: 9.6.0 npm page: https://www.npmjs.com/package/serve Module Description Assuming you would like to serve a static site, single page...

CVE-2018-7166

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause Buffer.alloc to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is...

CVE-2018-7166

CVE-2018-7166 is confirmed in connected sources as an issue in Node.js prior to 10.9.0 where Buffer.alloc() can return uninitialized memory due to misinterpretation of the encoding argument by the fill path. The effect is potential exposure of sensitive information if user-controlled inputs influ...

CVE-2018-12115

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding recognized by Node.js under the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le', Bufferwrite can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last...

CVE-2018-7166

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause Buffer.alloc to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying encoding can be passed as a number, this is...

CVE-2018-12115

CVE-2018-12115 is an out-of-bounds write in Node.js Buffer when using UCS-2/UTF-16LE encodings. Affected: all Node.js versions before 6.14.4, 8.11.4, and 10.9.0. Impact: writes starting near the buffer end can miscalculate max input length, enabling memory writes outside the buffer and potentiall...