413 matches found
Linux Distros Unpatched Vulnerability : CVE-2025-55131
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
CVE-2025-23084
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory...
CVE-2018-21268
The traceroute aka node-traceroute package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character...
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
Summary A Denial of Service DoS vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint /signalk/v1/access/requests. This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Details The...
Security Bulletin: IBM Documentation Offline is vulnerable to `Node.js ReadFileUtf8 and HTTP Parser flaws` due to Node.js (CVE-2025-23165, CVE-2025-23167)
Summary IBM Documentation Offline utilizes Node.js as a third-party component, which contains two vulnerabilities that could potentially affect your product's stability and security. CVE-2025-23165 CVSS: 3.7 is a Denial of Service DoS vulnerability in the ReadFileUtf8 internal binding. Repeated u...
Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics Advanced Certified Containers
Summary Multiple vulnerabilities were addressed in IBM Planning Analytics Advanced Certified Containers 3.1.2. Vulnerability Details CVEID:CVE-2025-23166 DESCRIPTION: The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a...
Node.js: fs.futimes() Bypasses Read-Only Permission Model
A flaw in Node.js's permission model was discovered that allowed a file's access and modification timestamps to be changed via futimes even when the process had only read permissions. Unlike utimes, futimes did not apply the expected write-permission checks, which meant file metadata could be...
EUVD-2018-0556
Malware in sbrugna...
EUVD-2021-1394
Malware in sbrugna...
EUVD-2017-0189
Malware in sbrugna...
EUVD-2017-0335
Malware in sbrugna...
EUVD-2018-0564
Malware in sbrugna...
EUVD-2016-7979
Malware in sbrugna...
EUVD-2021-0547
Malware in sbrugna...
EUVD-2020-29078
Malware in sbrugna...
EUVD-2018-4101
Malware in sbrugna...
EUVD-2018-4094
Malware in sbrugna...