Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to code injection due to CVE-2021-23406

Summary IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to code injection due to CVE-2021-23406 Vulnerability Details CVEID: CVE-2021-23406 DESCRIPTION: Node.js pac-resolver module could allow a remote attacker to execute arbitrary code on the system, caused b...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to regular expression denial of service due to a vulnerability in the Node.js validator module

Summary IBM App Connect Enterprise Certified Container may be vulnerable to a regular expression denial of service attack when parsing an Open API/Swagger document, due to a vulnerability in the Node.js validator module Vulnerability Details Third Party Entry: 207314 DESCRIPTION: Node.js validato...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32804

Summary IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32804. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-32804 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on t...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32803

Summary IBM App Connect Enterprise Certified Container may be vulnerable to directory traversal due to CVE-2021-32803. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-32803 DESCRIPTION: Node.js tar module could allow a local attacker to traverse directories on t...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940

Summary IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22940 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22930

Summary IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22930. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918

Summary IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22918 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an out-of-bounds read ...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to domain hijacking due to CVE-2021-22931

Summary IBM App Connect Enterprise Certified Container may be vulnerable to domain hijacking due to CVE-2021-22931. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22931 DESCRIPTION: Node.js could provide weaker than expected security, caused by missing input...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to trusting expired certificates due to CVE-2021-22939

Summary IBM App Connect Enterprise Certified Container may be vulnerable to trusting expired certificates due to CVE-2021-22939. This only affects Node.js runtime processes. Vulnerability Details CVEID: CVE-2021-22939 DESCRIPTION: Node.js could allow a remote attacker to bypass security...

Node.js Multiple Vulnerabilities (October 12th 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.7, 14.18.1 or 16.11.1. It is, therefore, affected by multiple HTTP smuggling vulnerabilities. An unauthenticated, remote attack could exploit these to bypass security controls, gain unauthorized access to sensitive data and...

Node.js Multiple Vulnerabilities (August 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.5 or 14.17.5 or 16.6.2. It is, therefore, affected by multiple vulnerabilities including the following: - A remote command execution vulnerability exists in Node.js due to insufficient validation of untypical characters in doma...

Node.js Multiple Vulnerabilities (August 31st 2021 Security Releases)

The version of Node.js installed on the remote host is prior to 12.22.6 or 14.17.6. It is, therefore, affected by multiple remote code execution vulnerabilities in various components due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this to bypass...

FreeBSD : Node.js -- October 2021 Security Releases (a9c5e89d-2d15-11ec-8363-0022489ad614)

Node.js reports : HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. HTTP Request Smuggling when parsing the body MediumCVE-2021-22960 The...

Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Summary IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities with details below Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling...

CVE-2021-22960

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

CVE-2021-22959

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an attacker can use this flaw to inject...

GHSA-MC7W-4CJF-C973 OS Command Injection in node-opencv

utils/find-opencv.js in node-opencv aka OpenCV bindings for Node.js prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands...

@finsemble/finsemble-electron-adapter (>=5.4.0, <=6.0.0), @innomind/studio (>=2.5.16, <=2.6.38) +19 more potentially affected by CVE-2021-39184 via electron (>=11.0.0, <=11.4.9)

electron NPM version =11.0.0, =5.4.0, =2.5.16, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.18.1, =0.32.0-alpha.47, =0.3.280, =1.0.0, =0.3.0, =4.0.1, =2.6.30, =2.6.42 - katex-screenshot 1.4.1 and more Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

@domoskanonos/nidoca-pwa (>=1.0.1, <=1.0.2), @finsemble/finsemble-electron-adapter (>=6.1.0-beta.20210707, <=6.2.1) +9 more potentially affected by CVE-2021-39184 via electron (>=13.0.1, <=13.2.3)

electron NPM version =13.0.1, =1.0.1, =6.1.0-beta.20210707, =0.26.3, =0.0.8, =0.0.1, =3.0.2, =1.3.17, =0.0.7, =2.0.29, =3.11.4, =5.4.2 - simple-git-gui 3.7.14 Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11 & v12 (CVE-2021-22930)

Summary IBM App Connect Enterprise v11 & v12 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions,...