CVE-2019-2391

CVE-2019-2391 affects the MongoDB js-bson library (version 1.1.3 and earlier). The issue arises from incorrect parsing of certain JSON input, which can cause js-bson to serialize BSON inaccurately, potentially leading to data disclosure or unexpected behavior in affected applications. Connected d...

CVE-2019-2391 JS-bson may incorrectly serialise some requests

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

CVE-2019-2391

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

CVE-2019-2391

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

JS-bson may incorrectly serialise some requests

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

CVE-2019-2391: Deserialization of Untrusted Data

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

GHSA-FQ77-7P7R-83RJ Directory Traversal in Next.js

Impact - Not affected: Deployments on ZEIT Now v2 https://zeit.co are not affected - Not affected: Deployments using the serverless target - Not affected: Deployments using next export - Affected: Users of Next.js below 9.3.2 We recommend everyone to upgrade regardless of whether you can reproduc...

Command Injection in quobject/aws-cli-js

Overview The issue occurs because a user input is formatted inside a command that will be executed without any check. The issue arises here. Proof of Concept Credit: Mik317 1. Create the following PoC file: js // poc.js var awsCli = require"aws-cli-js"; var Options = awsCli.Options; var Aws =...

Important: Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update

A minor version update from 7.5 to 7.6 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Vulnerability of the `exec` function in the gulp-scss-lint package from the NPM package manager, allowing attackers to execute arbitrary commands.

The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Insecure Random

crypto-js uses an insecure random. An attacker is able to guess and discover generated values due to biasness in the secureRandom function...

brew-js (>=0.1.0-beta, <=0.1.8), buildr (>=0.2.0, <=0.8.7) +9 more potentially affected by CVE-2020-7604 via pulverizr (0.7.0)

pulverizr NPM version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pulverizr and may be impacted: - brew-js =0.1.0-beta, =0.2.0, =0.1.0, =0.0.1, =0.0.2, =1.0.0, =0.1.0, =0.0.11, =0.0.12 Source cves: CVE-2020-7604 Source advisory:...

Remote Code Execution (RCE)

Microsoft Chakracore is vulnerable to remote code execution RCE. The vulnerability is possible due to lack of proper handling of raw objects and JS Maps to cache arbitrary data for a given locale...

CVE-2020-10386

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...

AZL-44115 CVE-2020-7598 affecting package js-jquery 3.5.0-4

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2020-5259 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2020-5259 Source advisory: OSV:GHSA-3HW5-Q855-G6CW...

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to properly process the HTTPs headers, resulting in a request smuggling attack. An attacker can use this flaw to alter a request sent as an authenticated user if the Node.js server is...

nodejs: HTTP header values do not have trailing optional whitespace trimmed

A flaw was found in Node.js where the HTTPs header values were not stripped of trailing whitespace. An attacker can use this flaw to send an HTTPs request which is validated by an upstream proxy server, but not by the Node.js HTTPs server...

08cms (1.0.0), 102f (>=1.0.0, <=1.0.1) +2205 more potentially affected by CVE-2019-10790 via taffydb (>=2.6.2, <=2.7.3)

taffydb NPM version =2.6.2, =1.0.0, =0.0.5, =1.0.0, =1.0.1-beta2, =1.0.40, =2.0.0-alpha.1, =1.6.0, =1.0.0, =1.0.1, =0.3.0, =1.0.2, =0.1.2, =0.2.0 - @adrian-alu0101024363/spread 0.1.3 and more Source cves: CVE-2019-10790 Source advisory: OSV:GHSA-MXHP-79QH-MCX6...