963 matches found
PT-2023-9687 Ā· Node.Js Ā· Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A flaw in the experimental permission model of Node.js version 20 allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used with a non-...
SUSE CVE-2023-30583
fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...
SUSE CVE-2023-30582
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a...
SUSE CVE-2023-30581
The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...
SUSE CVE-2023-30584
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an...
SUSE CVE-2023-30587
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the...
Node.js å®å Øę¼ę“
Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20 that stems from a lack of checks to bypass the experimental privilege model...
PT-2023-4531 Ā· Node.Js Ā· Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an...
PT-2023-4525 Ā· Node.Js Ā· Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: The issue is related to the fs.openAsBlob method in Node.js, which can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a...
PT-2023-4526 Ā· Node.Js Ā· Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A flaw has been identified in the experimental permission model of Node.js when the --allow-fs-read flag is used with a non- argument. This issue arises from an inadequate permission model that fails to restric...
PT-2023-4523 Ā· Node.Js Ā· Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability has been discovered in Node.js, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. The...
Tuesday June 20 2023 Security Releases
Tuesday June 20 2023 Security Releases Update 20-June-2023 Security releases available Updates are now available for all supported Node.js release lines for the following issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security adviso...
PT-2023-4496 Ā· Node.JsĀ +7 Ā· Node.JsĀ +7
Name of the Vulnerable Software and Affected Versions: Node.js versions v16, v18, and v20 Description: The issue is related to the use of proto in process.mainModule. proto .require, which can bypass the policy mechanism and allow requiring modules outside of the policy.json definition. This...
Password Disclosure
github.com/mattermost/mattermost-server is vulnerable to Password Disclosure. The vulnerability exists because the user passwords and user hashes were revealed in audit logs if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...
Node.js: Permissions policies can be bypassed via process.mainModule
A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...
Node.js: Permissions policies can be bypassed via process.mainModule
A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...
Malicious code in experimental-entrevista-react-01 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c994de6d5887278ea6db782133b3a5d4d6be0526117b52ed13889bdf94b4537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-319 Malicious code in experimental-entrevista-react-01 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c994de6d5887278ea6db782133b3a5d4d6be0526117b52ed13889bdf94b4537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Node.js: Permissions policies can be bypassed via Module._load.
Vulnerability description not provided...
CVE-2023-1831 User password logged in audit logs
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...