SUSE CVE-2023-30584

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an...

SUSE CVE-2023-30587

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20 that stems from a lack of checks to bypass the experimental privilege model...

PT-2023-4525 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: The issue is related to the fs.openAsBlob method in Node.js, which can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a...

PT-2023-4526 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A flaw has been identified in the experimental permission model of Node.js when the --allow-fs-read flag is used with a non- argument. This issue arises from an inadequate permission model that fails to restric...

PT-2023-4531 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module node:inspector. By exploiting the Worker class's ability to create an...

Tuesday June 20 2023 Security Releases

Tuesday June 20 2023 Security Releases Update 20-June-2023 Security releases available Updates are now available for all supported Node.js release lines for the following issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security adviso...

PT-2023-4523 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability has been discovered in Node.js, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. The...

PT-2023-4496 · Node.Js +7 · Node.Js +7

Name of the Vulnerable Software and Affected Versions: Node.js versions v16, v18, and v20 Description: The issue is related to the use of proto in process.mainModule. proto .require, which can bypass the policy mechanism and allow requiring modules outside of the policy.json definition. This...

Password Disclosure

github.com/mattermost/mattermost-server is vulnerable to Password Disclosure. The vulnerability exists because the user passwords and user hashes were revealed in audit logs if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

Node.js: Permissions policies can be bypassed via process.mainModule

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...

Node.js: Permissions policies can be bypassed via process.mainModule

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...

Malicious code in experimental-entrevista-react-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c994de6d5887278ea6db782133b3a5d4d6be0526117b52ed13889bdf94b4537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-319 Malicious code in experimental-entrevista-react-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c994de6d5887278ea6db782133b3a5d4d6be0526117b52ed13889bdf94b4537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Node.js: Permissions policies can be bypassed via Module._load.

Vulnerability description not provided...

CVE-2023-1831

CVE-2023-1831 affects Mattermost Server. When the experimental audit logging (ExperimentalAuditSettings) is enabled, audit logs fail to redact the user password during account creation and the user password hash in other operations, exposing sensitive credentials in logs. The vulnerability is des...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

PT-2023-17267 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns the failure to redact sensitive information from audit logs. Specifically, it affects the user password during user creation and the user password hash in other...

Node.js: Dependency Policy Bypass via process.binding

The use of the deprecated API process.binding allowed for the bypassing of the policy mechanism in Node.js, potentially enabling the execution of arbitrary code outside the defined limits in a policy.json file. This vulnerability affected all users utilizing the experimental policy feature in...