1406 matches found
Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it.(CVE-2021-36160)
Summary IBM Rational Build Forge version 8.0.x is affected by CVE-2021-36160 Vulnerability Details CVEID:CVE-2021-36160 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by an out-of-bounds read in modproxyuwsgi. By sending a specially crafted request uri-path, a remote...
Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Java version used in it.(CVE-2021-35560, CVE-2021-35586, CVE-2021-35578, CVE-2021-35564, CVE-2021-35559, CVE-2021-35556, CVE-2021-35565, CVE-2021-35588, CVE-2021-41035)
Summary IBM Rational Build Forge version 8.0 to 8.0.0.20 is affected by the Java version used in it. CVE-2021-35560, CVE-2021-35586, CVE-2021-35578, CVE-2021-35564, CVE-2021-35559, CVE-2021-35556, CVE-2021-35565, CVE-2021-35588, CVE-2021-41035 Vulnerability Details CVEID: CVE-2021-35560...
Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it.(CVE-2021-40438)
Summary IBM Rational Build Forge version 8.0.x is affected by CVE-2021-40438 Vulnerability Details CVEID: CVE-2021-40438 DESCRIPTION: Apache HTTP Server is vulnerable to server-side request forgery, caused by an error in modproxy. By sending a specially crafted request uri-path, a remote attacker...
Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-34798)
Summary IBM Rational Build Forge version 8.0.x is affected by CVE-2021-34798 Vulnerability Details CVEID: CVE-2021-34798 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by a NULL pointer dereference in httpd core. By sending a specially crafted request, a remote...
Security Bulletin: IBM Rational Build Forge is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228).
Summary IBM Rational Build Forge is vulnerable to CVE-2021-44228 as the jas.war is built upon Java-1.8 and leverages Apache Log4j 2.6.1 jar file. The fix includes Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute...
Server-Side Request Forgery (SSRF)
node-forge is vulnerable to server-side request forgery. The vulnerability exists in parseUrl because certain relative paths are mishandled when validating, which allows the bypass of the URL redirection validation...
Prototype Pollution
node-forge is vulnerable to prototype pollution. The vulnerability exists through the 'debug.set' function in 'debug.js' , allowing an attacker to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
Prototype Pollution in node-forge debug API.
Impact The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs...
GHSA-5RRQ-PXF6-6JX5 Prototype Pollution in node-forge debug API.
Impact The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs...
GHSA-WXGW-QJ99-44C2 Prototype Pollution in node-forge util.setPath API
Impact forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. Patches The forge.util.setPath API and related functions were removed in 0.10.0. Workarounds Don't call forge.util.setPath directly or indirectly with untruste...
00ld8nuivn (2.1.0), 00rqiw31nd (2.1.0) +8743 more potentially affected by unknown CVE via node-forge (>=0.1.15, <=0.9.2)
node-forge NPM version =0.1.15, =0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-forge and may be impacted: - 00ld8nuivn 2.1.0 - 00rqiw31nd 2.1.0 - 01dk01majk 2.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 ...
Prototype Pollution in node-forge util.setPath API
Impact forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. Patches The forge.util.setPath API and related functions were removed in 0.10.0. Workarounds Don't call forge.util.setPath directly or indirectly with untruste...
GHSA-GF8Q-JRPM-JVXQ URL parsing in node-forge could lead to undesired behavior.
Impact The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. Patches forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the...
URL parsing in node-forge could lead to undesired behavior.
Impact The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. Patches forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the...
URL Redirection
node-forge is vulnerable to URL redirection. The use of an insecure URL parsing in forge.util.parseUrl and forge.http.parseUrl alias allows a URL redirection to malicious site...
CVE-2022-0122
forge is vulnerable to URL Redirection to Untrusted Site...
CVE-2022-0122
CVE-2022-0122 — The initial description notes that the Forge (node-forge) library is vulnerable to URL Redirection to Untrusted Site. The connected documents confirm this CVE is present in the Forge project, with a reference to a Forge commit that relates to the issue, but there are no explicit p...
CVE-2022-0122
forge is vulnerable to URL Redirection to Untrusted Site...
