SUSE CVE-2021-3947

A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvmechangednslist where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information...

SUSE CVE-2022-3169

A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVMEIOCTLRESET and the NVMEIOCTLSUBSYSRESET through the device file of the driver, resulting in a PCIe link disconnect...

Cross-site Scripting (XSS)

eta is vulnerable to Cross-site Scripting XSS. The vulnerability exists in file-handlers.ts due to improper user-input sanitization from the Express API allowing an attacker to inject and execute malicious JavaScript...

Remote Code Execution (RCE)

eta is vulnerable to Remote Code Execution RCE. The vulnerability is due to the Express render API overwriting template engine configuration variables which allows an attacker to execute arbitrary codes. An application is only vulnerable if its rendering user submitted data without sanitization...

RHEL 7 : rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2023:0612)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0612 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

CVE-2023-23630

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

Design/Logic Flaw

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630

CVE-2023-23630 affects Eta, a JS templating engine used with Node/Express; the XSS vulnerability exists when user-supplied data is passed to res.render. Root cause is improper handling of input leading to script injection. The issue has been fixed in Eta v2.0.0. Workarounds include not passing us...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

XSS Attack with Express API

Impact XSS attack - anyone using the Express API is impacted Patches The problem has been resolved. Users should upgrade to version 2.0.0. Workarounds Don't pass user supplied data directly to res.renderFile. References Are there any links users can visit to find out more? See...

GHSA-XRH7-M5PP-39R6 XSS Attack with Express API

Impact XSS attack - anyone using the Express API is impacted Patches The problem has been resolved. Users should upgrade to version 2.0.0. Workarounds Don't pass user supplied data directly to res.renderFile. References Are there any links users can visit to find out more? See...

GHSA-VM5R-C87R-PF6X Parse Server option `masterKeyIps` vulnerability to IP spoofing

Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...

Parse Server option `masterKeyIps` vulnerability to IP spoofing

Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...

Debian dla-3299 : node-qs - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3299 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3299-1 [email protected] https://www.debian.org/lts/security/...

PT-2023-19091 · Eta +1 · Eta +1

Name of the Vulnerable Software and Affected Versions: Eta versions prior to 2.0.0 Description: The issue is related to a XSS attack that impacts anyone using the Express API. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents...

MAL-2023-946 Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-320 Malicious code in express-http-geobase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cc6b8a7571edb7965b16ec78583f4c16365b49bafd86d73309422cc51015aca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...