12313 matches found
CVE-2024-49770: Path Traversal: '.../...//'
oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default oak does not allow transferring of hidden files with Context.send API. However, prior to version 17.1.3, this can be bypassed by encoding / as its URL encoded...
nodejs:fuzz_cipheriv: Global-buffer-overflow in fuzz_cipheriv.cc
Detailed Report: https://oss-fuzz.com/testcase?key=4507588554719232 Project: nodejs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcipheriv Job Type: libfuzzerasannodejs Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x57ff98a91080 Crash State: fuzzcipheriv.cc Sanitizer:...
Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-749 advisory. A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model...
SUSE CVE-2020-26311
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...
SUSE CVE-2024-42461
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...
CVE-2024-10491
A flaw was found in the Express Node.js framework. In certain versions, an attacker may be able to trigger an arbitrary resource injection attack via the link header when unsanitized data is used...
Undici HTTP Header Injection
The vulnerability of the undici.request method in the Node.js software platform relates to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
ROS-20241029-08
Vulnerability in the OpenSearch software package related to improper validation of the nextUrl parameter. Exploitation of the vulnerability could allow an attacker to redirect a user to a malicious site A vulnerability in the server.maxHeadersCount configuration of the ws client-server library in...
K000148290: Moment.JS vulnerabilities CVE-2017-18214 and CVE-2022-24785
Security Advisory Description CVE-2017-18214 The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. CVE-2022-24785 Moment.js is a JavaScript date library for parsing, validating,...
Security Bulletin: Multiple Vulnerabilities in components for Cloud Pak System
Summary Vulnerabilities found in components packaged with Cloud Pak System, Node.js, Express, Axios. Vulnerability Details CVEID:CVE-2024-4068 DESCRIPTION: Node.js braces module is vulnerable to a denial of service, caused by the failure to limit the number of characters it can handle. leading to...
useragent Regular Expression Denial of Service vulnerability
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. PoC js async function exploit const useragent = require"useragent"; // Create a malicious user-agent that...
CVE-2020-26311
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...
CVE-2020-26311
The CVE-2020-26311 entry concerns the Node.js Useragent parser. The connected sources confirm a Regular Expression Denial of Service (ReDoS) vulnerability caused by one or more part-regular expressions within the useragent package, affecting all versions at the time of publication. The impact is ...
CVE-2020-26311 GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...
CVE-2020-26311 GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...
CVE-2020-26311: Inefficient Regular Expression Complexity
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no patches are available...
Security Bulletin: IBM Datapower Operations Dashboard could allow remote attacker to execute arbitrary commands on the system CVE-2017-16100
Summary dns-sync is used by the IBM Datapower Operations Dashboard implementation of networking operations Vulnerability Details CVEID:CVE-2017-16100 DESCRIPTION: Node.js dns-sync module could allow a remote attacker to execute arbitrary commands on the system, caused by the improper validation o...
RHSA-2024:1444 Red Hat Security Advisory: nodejs:16 security update
Bulletin has no description...