keystone cross-site scripting vulnerability

Keystone is one of the most powerful Node.js headless Cms. used to help you build and scale faster than any other Cms or application framework. keystone suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in web applications. An...

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities

Summary The IBM Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These have been addressed in IBM Planning Analytics 2.0 - IBM Planning Analytics Workspace 2.0.72. Vulnerability Details CVEID: CVE-2021-21366 DESCRIPTION: Node.js xmldom modu...

Security Bulletin: Vulnerability affects IBM Observability with Instana

Summary Vulnerabilities detected in Node.js versions before v14.17.4 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling...

Security Bulletin: Multiple vulnerabilities affect IBM Observability with Instana

Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2021-22921 DESCRIPTION: Node.js could allow a local attacker to gain elevated privileges on the system, caused by improper configuration of permissions in t...

Security Bulletin: Vulnerabilitiy affects IBM Observability with Instana

Summary Vulnerabilities detected in Node.js versions before v14.17.5 affects IBM Observability with Instana Vulnerability Details CVEID: CVE-2021-22940 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by an incomplete fix for CVE-2021-22930 related to a...

January 10th 2022 Security Releases

January 10th 2022 Security Releases Update 10-Jan-2022 Security releases available Updates are now available for the v17.x, v16.x, v14.x, and v12.x Node.js release lines for the following issues. Improper handling of URI Subject Alternative Names MediumCVE-2021-44531 Accepting arbitrary Subject...

Node.js -- January 2022 Security Releases

Node.js reports: Improper handling of URI Subject Alternative Names MediumCVE-2021-44531 Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN...

Out-of-Bounds read in stringstream

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream when using Node.js 4.x. WITHDRAWN This is a duplicate of GHSA-mf6x-7mm4-x2g7...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

Moderate: Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

Security Bulletin: IBM App Connect Enterprise Certified Container may be affected by CVE-2021-23807

Summary IBM App Connect Enterprise Certified Container may be affected by a prototype polution vulnerability in jsonpointer due to CVE-2021-23807, that could allow a remote attacker to execute aritrary code or perform a denial of service attack Vulnerability Details CVEID: CVE-2021-23807...

GHSA-53XV-C2HX-5W6Q Command Injection in node-windows

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Command Injection in node-windows

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Security Bulletin: Vulnerability in Node.js affects IBM Event Streams (CVE-2021-22959)

Summary There is a vulnerability in the Node.js open source runtime. The runtime is used by the IBM Event Streams. The CVE has been addressed. Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers...

Security Bulletin: Vulnerability in Node.js affects IBM Event Streams

Summary There is a vulnerability in the Node.js ua-parser-js open source module. The library is used by the IBM Event Streams. Vulnerability Details Third Party Entry: 211964 DESCRIPTION: Node.js ua-parser-js module could allow a remote attacker to execute arbitrary code on the system, caused by...

SQLite report about CVE-2022-21227

This CVE describes a bug in a third-party packages that provides a binding for SQLite to Node.js. The bug reported is in the third-party Node.js binding, not in SQLite itself. Do not be confused by the use of the word "SQLite" in the ambiguously-worded CVE description...

MGASA-2021-0592 Updated nodejs packages fix security vulnerability

HTTP Request Smuggling due to spaces in headers. The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. CVE-2021-22959 HTTP Request Smuggling when parsing the body. The parse ignores chunk extensions when parsing...

Wiki.js cross-site scripting vulnerability (CNVD-2022-09774)

Wiki.js is Requarks.io team of a set of Node.js-based and written in JavaScript language open source Wiki software . A cross-site scripting vulnerability exists in Wiki.js versions 2.0.0 beta.147 through 2.5.255, which can be exploited by an attacker to cause an account takeover when accessed by ...

CVE-2021-43856

Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser e.g...

CVE-2021-43856

Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser e.g...