12 bug fix update

An update is available for nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The following packages have been upgraded to a later...

ALBA-2019:4275 nodejs:12 bug fix update

The following packages have been upgraded to a later upstream version: nodejs 12.13.1. BZ1776116...

GHSA-H9RV-JMMF-4PGX Cross-Site Scripting in serialize-javascript

Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 2.1.1 or later...

Node.js: Remotely trigger an assertion on a TLS server with a malformed certificate string

Summary: Connecting to a NodeJS TLS server with a client certificate that has a type 19 string in its subjectAltName will crash the TLS server if it tries to read the peer certificate. Affected versions include v10.17.0 and v13.1.0. This is related to issue...

Critical Photon OS Security Update - PHSA-2019-0257

Updates of 'yum', 'linux', 'subversion', 'libarchive', 'libxslt', 'binutils', 'linux-esx', 'nodejs', 'python2', 'postgresql', 'libsoup' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-1.0-0257

An update of 'libsoup', 'postgresql', 'yum', 'nodejs', 'libxslt', 'binutils', 'libarchive', 'python2' packages of Photon OS has been released...

Critical Photon OS Security Update - PHSA-2019-0190

Updates of 'ncurses', 'yum', 'libsoup', 'binutils', 'python2', 'postgresql', 'nodejs' packages of Photon OS have been released...

AZL-44412 CVE-2016-1000236 affecting package nodejs-nodemon 2.0.3-5

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

new module: nodejs:12

This enhancement update adds the nodejs:12 module to AlmaLinux BZ1685191 For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

new module: nodejs:12

An update is available for nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This enhancement update adds the nodejs:12 module to...

ALEA-2019:3461 new module: nodejs:12

This enhancement update adds the nodejs:12 module to AlmaLinux BZ1685191 For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Node.js third-party modules: [git-promise] RCE via insecure command formatting

I would like to report a RCE issue in the git-promise module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: git-promise version: 0.3.1 npm page: https://www.npmjs.com/package/git-promise Module Description Simple wrapper that allows you to run any git...

Exploit for OS Command Injection in Rambox

CVE-2019-17625 There is a stored XSS vulnerability in rambox...

Node.js third-party modules: [git-lib] RCE via insecure command formatting

I would like to report a RCE issue in the git-lib module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: git-lib version: 1.6.0 npm page: https://www.npmjs.com/package/git-lib Module Description A library that contains different methods to be consumed ...

Moderate: Red Hat Security Advisory: ovirt-web-ui security and bug fix update

An update for ovirt-web-ui is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Oracle Linux 8 : nodejs:10 (ELSA-2019-2925)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2925 advisory. nodejs-packaging 17-3 - Change Requires to Recommends on nodejs dependency, so it is usable for building nodejs Tenable has extracted the preceding...

nodejs: Hostname spoofing in URL parser for javascript protocol

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" e.g. "javAscript:" protoc...

Denial Of Service (DoS)

nodejs is vulnerable to denial of service. A remote attacker is able to crash the application by flooding the server with empty frames which results in excessive resource consumption...

Denial Of Service (DoS)

nodejs is vulnerable to denial of service. An attacker is able to crash the application by requesting for large response, which causes the server to consume excessive memoty that leads to a denial of service condition...

RHEL 8 : nodejs:10 (RHSA-2019:2925)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2925 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...