8764 matches found
CVE-2021-43787
NodeBB (NodeBB) contains a prototype pollution vulnerability in the uploader module affecting multiple 1.x versions, leading to arbitrary data injection into the DOM and potential account takeover when combined with a path traversal issue. The issue is documented under CVE-2021-43787 and has been...
Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-32803)
Summary IBM Integration Bus ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-32803 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on the system,...
PYSEC-2021-861
Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...
CVE-2021-40830
CVE-2021-40830 affects the AWS IoT Device SDK v2 for Java, Python, C++, and Node.js on Linux/Unix. The root cause is that the SDK appends a user-supplied CA to the system trust store instead of overriding it, which can allow TLS handshakes to succeed using either the user-supplied CA or the defau...
CVE-2021-40829
CVE-2021-40829 affects AWS IoT Device SDK v2 for Java, Python, C++, and Node.js on macOS. The root cause was TLS hostname verification not being performed when clients override CA trust stores, allowing potential hostname-mismatch issues in TLS handshakes. The issue is tied to the aws-c-io submod...
CVE-2021-40828
CVE-2021-40828 affects AWS IoT Device SDK v2 on Windows prior to specific versions: Java < 1.3.3, Python < 1.5.18, C++ < 1.12.7, Node.js
CVE-2021-3918
The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-39134 DESCRIPTION: Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack, caused by the...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-37701 DESCRIPTION: Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-37713 DESCRIPTION: Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-37712 DESCRIPTION: Node.js tar module could allow a local attacker to execute arbitrary code on the system, caused by an...
Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021
Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-39135 DESCRIPTION: Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack. By replacing...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4 images and security updates
Red Hat Advanced Cluster Management for Kubernetes 2.4.0 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-32804)
Summary IBM Integration Bus ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-32804 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on the system,...
GHSA-Q9Q6-F556-GPM7 Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Node.js ECDSA library ecdsa-node 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
Improper Verification of Cryptographic Signature in starkbank-ecdsa
The verify function in the Stark Bank Node.js ECDSA library ecdsa-node 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i
Summary Vulnerabilities detected in Node.js versions before v14.16.2 that affect the Cordova platform packaged with Rational Developer for i Software. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...
Apostrophe licensing issue vulnerability
Apostrophe is a full-featured open source Cms built with Node.js by Apostrophe, Inc. designed to empower organizations by combining contextual editing and headless architecture in a full-stack Js environment.Apostrophe CMS is vulnerable to an authorization issue in versions 2.63.0 through 3.3.1,...
