Design/Logic Flaw

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result...

CVE-2023-32005

CVE-2023-32005 affects Node.js 20 when using the experimental permission model. The issue stems from an inadequate permission model that fails to restrict file stats via fs.statfs, allowing a user with --allow-fs-read and a non-* path to retrieve stats on files they do not have read access to. Af...

The vulnerability of the fs.watchFile method in the Node.js software platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the fs.watchFile method in the Node.js software platform is related to errors in using the --allow-fs-read flag with an argument other than =. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the fs.openAsBlob() method in the Node.js software platform allows attackers to compromise the integrity of protected information.

The vulnerability of the fs.openAsBlob method in the Node.js programming platform is related to errors in using the --allow-fs-read flag for file system access. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...

CVE-2023-32005

A vulnerability was found in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result, malicious actors ca...

Linux kernel smb2misc.c file out-of-bounds read vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An out-of-bounds read vulnerability exists in versions of Linux kernel prior to 6.3.10, which stems from the fact that fs/smb/server/smb2misc.c does not validate the relationsh...

Linux kernel smb2pdu.c file out-of-bounds read vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An out-of-bounds read vulnerability exists in versions of Linux kernel prior to 6.3.4, which stems from fs/ksmbd/smb2pdu.c not properly checking the UserName value, and can be...

Design/Logic Flaw

An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read...

CVE-2023-38427

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemblenegcontexts...

CVE-2023-38427

The connected documents confirm CVE-2023-38427 affects the Linux kernel (ksmbd) via an integer underflow and an out-of-bounds read in fs/smb/server/smb2pdu.c (deassemble_neg_contexts) and that a fix was released in Linux kernel 6.3.8. Practical impact is high due to potential data exposure and co...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. An out-of-bounds read vulnerability exists in versions of Linux kernel prior to 6.3.4, which stems from fs/ksmbd/smb2pdu.c not properly checking the UserName value, and can be...

CVE-2023-38429

The CVE-2023-38429 issue is reported in the Linux kernel (pre-6.3.4) within ksmbd: fs/ksmbd/connection.c contains an off-by-one error in memory allocation (ksmbd_smb2_check_message), which can cause out-of-bounds access. Connected advisories (Astra Linux, Nessus plugin references) corroborate the...

CVE-2023-35693

CVE-2023-35693 affects the IncFS kernel component (fs/incfs/vfs.c). The issue is a use-after-free that can cause memory corruption, enabling local privilege escalation with system execution privileges required. Exploitation details are not provided in the supplied documents. The bulletins referen...

MAL-2023-568 Malicious code in literal-fs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a6301bbe43b32cb4560eeb8b8cf7525ae5d1e18f851406ee8d72a4dcd0eb494 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in literal-fs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a6301bbe43b32cb4560eeb8b8cf7525ae5d1e18f851406ee8d72a4dcd0eb494 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Node.js: process.binding() can bypass the permission model through path traversal

The use of the deprecated API process.binding allowed for bypassing the permission model in Node.js 20.x through path traversal...

CVE-2023-30582

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument...

PT-2025-38350

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.142-1-generic, 5.10.142-1-hardened, 6.1.50-1-generic, and 6.1.90-1-generic Description The Linux kernel contains a flaw in the net/mlx5e module, specifically within the mlx5e fs tt redirect any create...

SUSE CVE-2023-30582

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a...

PT-2023-4525 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: The issue is related to the fs.openAsBlob method in Node.js, which can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a...