CLSA-2026-1773015256 TuxCare security update for moment-timezone (2 CVEs)

TuxCare rebuilt moment-timezone to address 2 CVEs. Fixed in 0.4.1-tuxcare.1...

PT-2026-73882

TuxCare rebuilt moment-timezone to address 2 CVEs. Fixed in 0.4.1-tuxcare.1...

Security Bulletin: Vulnerabilities in Moment-Timezone and Node.js might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Moment-Timezone and Node.js. Vulnerabilities include an attacker could exploit this vulnerability to execute arbitrary commands on the system and an attacker could exploit this vulnerability to launch a...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficient regular expression complexity. By sending a...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details CVEID:CVE-2022-43441 DESCRIPTION: Ghost node-sqlite3 could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager HA GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote attacker to execute arbitrary commands on the system, caused by a...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager HA GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details IBM X-Force ID: 238619 DESCRIPTION: Moment Moment-Timezone is vulnerable to a man-in-the-middle attack, caused by cleartext transmission of tz data durin...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager DR GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. No impacts to VM Recovery Manager HA and DR cli. Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote attacker to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to [X-Force 238619]

Summary Node.js moment-timezone is used by IBM App Connect Enterprise Certified Container for handling timezone information. IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to X-Force 237819

Summary Node.js moment-timezone is used by IBM App Connect Enterprise Certified Container for handling timezone information. IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to Node.js module moment-timezone (IBM X-Force ID: 237819)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to Node.js module moment-timezone IBM X-Force ID: 237819. The fix includes a version of moment-timezone 0.5.35 Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote...

WS-2022-0280

All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via "grunt data:2014d", where "2014d" stands for the version of the tzdata to be used from IANA's website, and Alice let'...

GHSA-56X4-J7P9-FCF9 Command Injection in moment-timezone

Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website, and Alice...

6brain (>=0.0.1, <=0.0.2), 6sense (>=0.0.1, <=1.1.5) +1881 more potentially affected by unknown CVE via moment-timezone (>=0.1.0, <=0.5.34)

moment-timezone NPM version =0.1.0, =0.0.1, =0.0.1, =4.11.0, =4.13.7-rc4, =1.70.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-56X4-J7P9-FCF9...

6brain (>=0.0.1, <=0.0.2), 6sense (>=0.0.1, <=1.1.5) +1881 more potentially affected by unknown CVE via moment-timezone (>=0.1.0, <=0.5.34)

moment-timezone NPM version =0.1.0, =0.0.1, =0.0.1, =4.11.0, =4.13.7-rc4, =1.70.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: unknown CVE Source advisory: GHSA-56X4-J7P9-FCF9...

Command Injection in moment-timezone

Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website, and Alice...

6brain (>=0.0.1, <=0.0.2), 6sense (>=0.0.1, <=1.1.5) +1881 more potentially affected by unknown CVE via moment-timezone (>=0.1.0, <=0.5.34)

moment-timezone NPM version =0.1.0, =0.0.1, =0.0.1, =4.11.0, =4.13.7-rc4, =1.70.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-V78C-4P63-2J6C...

6brain (>=0.0.1, <=0.0.2), 6sense (>=0.0.1, <=1.1.5) +1881 more potentially affected by unknown CVE via moment-timezone (>=0.1.0, <=0.5.34)

moment-timezone NPM version =0.1.0, =0.0.1, =0.0.1, =4.11.0, =4.13.7-rc4, =1.70.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: unknown CVE Source advisory: GHSA-V78C-4P63-2J6C...

Cleartext Transmission of Sensitive Information in moment-timezone

Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...

PT-2022-28282 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions prior to 0.5.35 Description: The issue arises when using grunt data or grunt release to prepare a custom build of moment-timezone with the latest tzdata from IANA's website. If an attacker intercepts the request to...