6880 matches found
ALSA-2024:2778 Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: c-ares: Out of bounds read in aresreadline CVE-2024-25629 nghttp2: CONTINUATION frames DoS CVE-2024-28182 nodejs: using the fetch function to...
ALSA-2024:2779 Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: CONTINUATION frames DoS CVE-2024-27983 nodejs: using the fetch function to retrieve content from an untrusted URL leads to denial of servi...
Important: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: CONTINUATION frames DoS CVE-2024-27983 nodejs: using the fetch function to retrieve content from an untrusted URL leads to denial of servi...
PT-2024-25786
Name of the Vulnerable Software and Affected Versions CmsEasy version 7.7.7.9 Description A local file inclusion issue was discovered, allowing attackers to read arbitrary files via the file get contents function in the fetch action method of "/admin/template admin.php". Recommendations For CmsEa...
SUSE CVE-2024-27058
In the Linux kernel, the following vulnerability has been resolved: tmpfs: fix race on handling dquot rbtree A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree. Fetching the rbtree root node must also be protected by the dqopt-dqiosem, otherwise,...
PT-2024-24344 · Mealie · Mealie
Name of the Vulnerable Software and Affected Versions: Mealie versions prior to 1.4.0 Description: Mealie, a self-hosted recipe manager and meal planner, has an issue where an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole,...
PT-2024-24343 · Mealie · Mealie
Name of the Vulnerable Software and Affected Versions: Mealie versions prior to 1.4.0 Description: The issue concerns the scrape image function, which retrieves an image based on a user-provided URL without validating if the URL points to an external location and lacks enforced rate limiting. The...
PT-2024-15089 · WordPress · The Rss Aggregator By Feedzy – Feed To Post
Name of the Vulnerable Software and Affected Versions: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to, and including, 4.4.7 Description: The plugin is vulnerable to Blind Server-Side Request Forgery via the fetc...
openSUSE Security Advisory (SUSE-SU-2024:1309-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
...
Node.js fetch DoS
The vulnerability of the fetch function in HTTP/1.1 in Node.js software platforms is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...
CVE-2024-31303
Cross-Site Request Forgery CSRF vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets.This issue affects Sign-up Sheets: from n/a through = 2.2.11.1...
CVE-2024-31303
CVE-2024-31303 corresponds to a CSRF vulnerability in the WordPress Sign-up Sheets plugin (versions up to 2.2.11.1). Affected software is Sign-up Sheets for WordPress; root cause is CSRF, with potential impact described as I=Low, C=None, A=None, requiring user interaction (UI:R). The description ...
Fedora 38 : nodejs-undici (2024-6d9c1da54f)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6d9c1da54f advisory. Update to version 6.11.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
PT-2024-23951 · Unknown · Fetch Designs Sign-Up Sheets
Name of the Vulnerable Software and Affected Versions: Fetch Designs Sign-up Sheets versions n/a through 2.2.11.1 Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web applicatio...
CVE-2024-31303: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets.This issue affects Sign-up Sheets: from n/a through = 2.2.11.1...
Fedora 39 : nodejs-undici (2024-ad51aa23c3)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ad51aa23c3 advisory. Update to version 6.11.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...
SUSE CVE-2024-30261
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch, allowing fetch to accept requests as valid even if they have been tampered. This vulnerability was patched in versions 5.28.4 and 6.11.1...
DEBIAN-CVE-2021-47190
In the Linux kernel, the following vulnerability has been resolved: perf bpf: Avoid memory leak from perfenvinsertbtf perfenvinsertbtf doesn't insert if a duplicate BTF id is encountered and this causes a memory leak. Modify the function to return a success/error value and then free the memory if...
