The vulnerability of the nodered function of the D-Link G416 router’s HTTP microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the nodered function of the D-Link G416 router’s HTTP microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by...

VulnCheck KEV: CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

The vulnerability of the application programming interface of the graphical programming environment for creating threaded applications, Node-Red, allows a hacker to modify the default JavaScript object prototype.

The vulnerability of the application programming interface of the graphical programming environment for creating threaded applications like Node-Red is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability could allow a...

VulnCheck KEV: CVE-2021-3223

Node-RED-Dashboard before 2.26.2 allows uibase/js/..%2f directory traversal to read files...

CVE-2021-26504

Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js...

CVE-2021-26504

Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js...

Directory traversal

Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js...

node-red-contrib-huemagic path traversal vulnerability

node-red-contrib-huemagic is a solution for Foddy individual developers. A security vulnerability exists in Foddy node-red-contrib-huemagic version 3.0.0, which stems from a directory traversal vulnerability. An attacker can exploit this vulnerability to obtain sensitive information by sending a...

CVE-2021-26504

CVE-2021-26504 affects Foddy’s node-red-contrib-huemagic (v3.0.0). The vulnerability is a directory traversal in the hue-magic.js res.sendFile API, enabling remote attackers to read sensitive information. CVSS v3.1 base score 7.5 (HIGH) with NETWORK attack vector, LOW attack complexity, and no pr...

Malicious code in node-red-contrib-tfjs-object-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ae6d965935a10741f1389a09905356a09e9d7358dc5e8d1e3b56fac4602c78d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-633 Malicious code in node-red-contrib-tfjs-object-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ae6d965935a10741f1389a09905356a09e9d7358dc5e8d1e3b56fac4602c78d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-VRV9-3X3W-FFXW node-red-dashboard vulnerable to Cross-site Scripting

node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0...

@automatacontrols/automata-thermostat (>=1.0.7 <=1.0.12), @clysema/node-red-contrib-ui-week-schedule (>=0.1.0 <=0.1.4) +30 more potentially affected by CVE-2022-3783 via node-red-dashboard (>=2.13.2 <=3.1.7)

node-red-dashboard NPM version =2.13.2, =1.0.7, =0.1.0, =0.0.1, =1.0.0, =2.0.0, =0.3.0, =0.0.5, =1.0.5-alpha.11, =2.5.0, =0.0.3, =1.2.0, =0.5.1, =0.8.0 - mtr-dashboard =0.0.1 and more Source cves: CVE-2022-3783 Source advisory: OSV:GHSA-VRV9-3X3W-FFXW...

node-red-dashboard vulnerable to Cross-site Scripting

node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0...

CVE-2022-3783

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...

CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...

CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...

PT-2022-24104 · Node Red · Node-Red-Dashboard

Name of the Vulnerable Software and Affected Versions: node-red-dashboard versions prior to 3.2.0 Description: A cross-site scripting issue has been found in the node-red-dashboard, affecting the ui text Format Handler component, specifically in the file...

CVE-2022-3783 node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting

A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component uitext Format Handler. The manipulation leads to cross site scripting. The attack may be...