CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

Design/Logic Flaw

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

CVE-2022-33987

CVE-2022-33987 affects the Node.js got package. The vulnerability allows a redirect to a UNIX socket due to how redirects are handled. IBM/related advisories confirm the issue and that fixes are in got v12.1.0 and v11.8.5. Remediation: upgrade to 12.1.0+ (or 11.8.5+). Base scoring shown as MEDIUM...

CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

CVE-2022-33987

The got package before 12.1.0 also fixed in 11.8.5 for Node.js allows a redirect to a UNIX socket...

Authentication flaw

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

CVE-2022-31083 Authentication bypass in Parse Server Apple Game Center auth adapter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...

npm pg-native 代码问题漏洞

npm pg-native is a high-performance native binding between node.js and PostgreSQL from US-based npm, using a simple API via libpq. A code issue vulnerability exists in pg-native that stems from the plugin's susceptibility to a denial of service DoS when it attempts to convert the second parameter...

@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29247 via electron (>=17.0.0, <=17.1.2)

electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

Security Bulletin: IBM Sterling Control Center is vulnerable to server-side request forgery due to Node.js axios module (CVE-2020-28168)

Summary Node.js axios module is used by IBM Sterling Control Center. A server-side request forgery vulnerability in Node.js axios module has been addressed. Vulnerability Details CVEID: CVE-2020-28168 DESCRIPTION: Node.js axios module is vulnerable to server-side request forgery, caused by improp...

Internet Bug Bounty: Undici ProxyAgent vulnerable to MITM

Full GitHub advisory summarizing the issue is here: https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33 The original Node.js HackerOne report is here: https://hackerone.com/bugs?reportid=1583680 This was fixed & disclosed in Undici v5.5.1. This primarily affects Undici, a...

CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

Code injection

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

CVE-2022-29244

CVE-2022-29244: npm pack/publish in a workspace may publish files excluded by root .gitignore/.npmignore. Affected: npm v7.9.0 and v7.13.0; patched in npm v8.11.0. Node.js v16.15.1, v17.19.1, v18.3.0 include the patched npm. Remediation: upgrade npm to the latest (npm i -g npm@latest).

CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...