Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation

Summary Multiple vulnerabilities in IBM Robotic Process Automation Vulnerability Details CVEID: CVE-2022-0235 DESCRIPTION: Node.js node-fetch could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when fetching a remote url with Cookie. By sending a...

GHSA-M7XQ-8JP8-RJ2C Command injection in npm-dependency-versions

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

Command injection in npm-dependency-versions

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

payload-plugin-cloud-storage (>=0.0.1, <=1.1.0), payload-plugin-form-builder (1.0.0) potentially affected by CVE-2022-27952 via payload (>=0.8.2, <=0.14.0)

payload NPM version =0.8.2, =0.0.1, =1.1.0 - payload-plugin-form-builder 1.0.0 Source cves: CVE-2022-27952 Source advisory: OSV:GHSA-W8XH-93QH-35VW...

CVE-2022-29080

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

Command injection

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

CVE-2022-29080

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

CVE-2022-29080

The npm-dependency-versions package for Node.js (≤ 0.3.0) is vulnerable to command injection via dependencyVersions called with a JSON object containing a pkgs key and a value with shell metacharacters, enabling arbitrary command execution. Root cause: insufficient input validation on the pkgs fi...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to arbitrary code execution due to CVE-2021-23555

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in a Designer flow. IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to CVE-2021-23555. This bulletin provides patch information ...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to log4js-node CVE-2022-21704

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to log4js-node CVE-2022-21704 with details below Vulnerability Details CVEID: CVE-2022-21704 DESCRIPTION: log4js-node module for Node.js could allow a local authenticated attacker to obtain sensitive...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js with details below Vulnerability Details CVEID: CVE-2021-44533 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect...

edge.js cross-site scripting vulnerability

edge.js is the Node.js template engine. edges.js versions prior to 5.3.2 have a cross-site scripting vulnerability that stems from a type obfuscation vulnerability that can be exploited to bypass input cleanup when the input to be rendered is an array, even if is used, and can be used by attacker...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +7645 more potentially affected by CVE-2021-43138 via async (>=2.0.0, <=2.6.3)

async NPM version =2.0.0, =1.0.1, =2.3.0, =1.0.7, =0.0.1, =0.0.2, =0.0.2, =0.3.0, =0.4.0, =1.2.2 - @36node/template-service 0.3.5 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

@0xcert/ethereum-bitski-backend-provider (>=2.0.0-alpha10, <=2.0.3), @0xcert/ethereum-bitski-frontend-provider (>=2.0.0-alpha10, <=2.0.3) +857 more potentially affected by CVE-2021-43138 via async (>=3.0.0, <=3.2.1)

async NPM version =3.0.0, =2.0.0-alpha10, =2.0.0-alpha10, =4.3.0, =0.0.6-1, =3.6.5, =0.0.73, =1.5.1, =1.7.58, =0.0.1, =1.3.6, =13.0.6, =5.1.1, =1.3.1, =0.0.2-next.4, =0.4.0-next.28 - @ahm-monash/private-test 1.0.0 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

The vulnerability of the Node.js software platform, related to the use of memory after it is freed, allows a attacker to compromise data integrity.

The vulnerability of the Node.js software platform is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

The Bug Report - March 2022 Edition

The Bug Report - March 2022 By Charles McFarland · April 6, 2022 Your Cybersecurity Comic Relief Comic from https://geek-and-poke.com/ and remains unedited. https://creativecommons.org/licenses/by/3.0/ Use of this comic does not indicate endorsement by the creator. Why am I here? Welcome back the...

The vulnerability of the Node.js software platform, related to resource management errors, allows a hacker to trigger a service failure.

The vulnerability of the Node.js software platform is related to resource management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

GHSA-28XR-MWXG-3QC8 Command injection in simple-git

simple-git maintained as git-js named repository on GitHub is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring instances may be vulnerable to denial of service due to CVE-2022-21681

Summary Node.js module marked is used by IBM App Connect Enterprise Certified Container when creating an API-based Designer flow. IBM App Connect Enterprise Certified Container DesignerAuthoring instances may be vulnerable to regular expression denial of service. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring instances may be vulnerable to denial of service due to CVE-2022-21680

Summary Node.js module marked is used by IBM App Connect Enterprise Certified Container when creating an API-based Designer flow. IBM App Connect Enterprise Certified Container DesignerAuthoring instances may be vulnerable to regular expression denial of service. This bulletin provides patch...