Important Photon OS Security Update - PHSA-2020-3.0-0150

Updates of 'nodejs' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2020-0150

Updates of 'nodejs' packages of Photon OS have been released...

SUSE-SU-2020:2829-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - nodejs10 was updated to 10.22.1 LTS: - CVE-2020-8252: Fixed a buffer overflow in realpath bsc1176589. - CVE-2020-15095: Fixed an information leak through log files bsc1173937. - Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation...

SUSE-SU-2020:2812-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: - nodejs12 was updated to 12.18.4 LTS: - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion bsc1176605. - CVE-2020-8252: Fixed a buffer overflow in realpath bsc1176589. - CVE-2020-15095: Fixed an information leak...

CVE-2019-20920

A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to...

CVE-2019-20922

A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of...

Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details...

CVE-2020-8237

A flaw was found in nodejs-json-bigint. A Prototype pollution in json-bigint npm may lead to a denial-of-service DoS attack...

ALPINE-CVE-2020-8252

The implementation of realpath in libuv 10.22.1, 12.18.4, and 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes...

ALPINE-CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

CVE-2020-8251

Node.js 14.11.0 is vulnerable to HTTP denial of service DoS attacks based on delayed requests submission which can make the server unable to accept new connections...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

Information disclosure

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

Summary: CVE-2020-1694 affects Keycloak before 10.0.0 where the NodeJS adapter did not support verify-token-audience, enabling some users to access sensitive information outside their permissions. What’s affected: Keycloak (and Red Hat SSO built on Keycloak) with the NodeJS adapter lacking verify...

CVE-2020-1694: Permissive List of Allowed Inputs

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

PT-2020-14897

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 10.0.0 Description A flaw was found in Keycloak where the NodeJS adapter did not support the verify-token-audience. This results in some users having access to sensitive information outside of their permissions...

@balljs/cli (>=0.0.1, <=0.0.4), @getcronit/pylon-dev (>=1.0.0-beta.1, <=1.0.6) +9 more potentially affected by unknown CVE via treekill (>=0.0.0, <=1.0.0)

treekill NPM version =0.0.0, =0.0.1, =1.0.0-beta.1, =0.0.34, =0.0.9-beta.1, =2.0.0-rc.13, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: GHSA-533P-G2HQ-QR26...