CVE-2023-32003 vulnerabilities

Vulnerabilities for packages: nodejs...

SUSE CVE-2023-32003

fs.mkdtemp and fs.mkdtempSync can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the...

SUSE CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

CVE-2023-32558

A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding can bypass the permission model through path traversal. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product...

CVE-2023-32004

A vulnerability was found in NodeJS. This security issue occurs as improper handling of buffers in file system APIs, causing a traversal path to bypass when verifying file permissions. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the R...

CVE-2023-32003

A vulnerability was found in NodeJS. This security issue occurs as fs.mkdtemp and fs.mkdtempSync can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp API, and the impact is a malicious actor could create an arbitra...

Malicious code in wasabi-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a47529c7afca95337513fc02161d3429f5b5e4fa1ff3f80484688148b152ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1076 Malicious code in wasabi-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a47529c7afca95337513fc02161d3429f5b5e4fa1ff3f80484688148b152ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AlmaLinux 8 : nodejs:18 (ALSA-2023:4536)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4536 advisory. nodejs: mainModule.proto bypass experimental policy mechanism CVE-2023-30581 nodejs: process interuption due to invalid Public Key information in x509...

Node.js Security Vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20, which stems from a vulnerability that allows an attacker to retrieve statistical information from restricted files using fs.statfs...

Important: nodejs

Issue Overview: Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range. CVE-2022-25883 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2...

Moderate: Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs: mainModule.proto bypass experimental policy mechanism

A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition...

RHEL 8 : nodejs:18 (RHSA-2023:4536)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4536 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

RHEL 8 : nodejs:16 (RHSA-2023:4537)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4537 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

CVE-2023-30589 affecting package nodejs for versions less than 16.20.1-2

CVE-2023-30589 affecting package nodejs for versions less than 16.20.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-31147 affecting package nodejs for versions less than 16.20.1-2

CVE-2023-31147 affecting package nodejs for versions less than 16.20.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2023-31130 affecting package nodejs for versions less than 16.20.1-2

CVE-2023-31130 affecting package nodejs for versions less than 16.20.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-4904 affecting package nodejs for versions less than 16.20.1-2

CVE-2022-4904 affecting package nodejs for versions less than 16.20.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-25881 affecting package nodejs for versions less than 16.20.1-2

CVE-2022-25881 affecting package nodejs for versions less than 16.20.1-2. An upgraded version of the package is available that resolves this issue...