12898 matches found
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module...
PT-2025-1051
Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.0.16 FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 Description An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote attacker to gain super-admin privileges via...
Fortinet FortiOS and FortiProxy security vulnerabilities
Fortinet FortiOS and Fortinet FortiProxy are both products of Fortinet, Inc.Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content...
Fortinet Fortigate Authentication bypass in Node.js websocket module and CSF requests (FG-IR-24-535)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-535 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 affecting FortiOS 7.0.0 through...
Authentication bypass in Node.js websocket module and CSF requests
...
CVE-2024-27980: Improper Neutralization of Special Elements used in a Command
Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...
Node.js security vulnerabilities
Node.js is an open source, cross-platform JavaScript runtime environment open-sourced by Node.js. A security vulnerability exists in Node.js that stems from mishandling of batch files, which allows malicious command line arguments to inject arbitrary commands and enable code execution even if she...
Security Bulletin: A vulnerability in the follow-redirect module affects IBM Db2 Big SQL on Cloud Pak for Data
Summary A vulnerability in the node.js follow-redirect module affects IBM Db2 Big SQL 7.6 on Cloud Pak for Data 4.8 Vulnerability Details CVEID:CVE-2024-28849 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by the...
Security Bulletin: Security Vulnerabilities in node.js packages affect IBM Voice Gateway
Summary Security Vulnerabilities in node.js packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-21538 DESCRIPTION: Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to...
Upcoming CVE for End-of-Life Node.js Versions
Upcoming CVE for End-of-Life Node.js Versions The Node.js Project is committed to ensuring the security and reliability of applications built on Node.js. As part of this commitment, we regularly review measures to help our users stay informed about security risks. Announcement We will soon issue ...
PT-2025-21252
Name of the Vulnerable Software and Affected Versions: nodejs affected versions not specified Description: The issue is related to a corrupted pointer in the node::fs::ReadFileUtf8const FunctionCallbackInfoValue& args function when the args0 is a string. This is a problem in the nodejs package,...
PT-2025-21253
Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 24.x Description Node.js is susceptible to a remote crash issue due to a flaw in the SignTraits::DeriveBits function. This flaw can be triggered by malformed crypto input in background threads, leading to a...
PT-2025-21254
Name of the Vulnerable Software and Affected Versions: Node.js versions prior to the llhttp v9 upgrade node-undici in Debian Linux affected versions not specified Description: A flaw in the HTTP parser of Node.js allows improper termination of HTTP/1 headers using r rX instead of the required r r...
UBUNTU-CVE-2024-56334
systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. This...
CVE-2024-56334
systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the "getWindowsIEEE8021x" function. This means that malicious content in the SSID can be executed as OS commands. This...
CVE-2024-56334 Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. This...
Security Bulletin: Vulnerabilities in Node.js Elliptic module may affect IBM watsonx Assistant for IBM Cloud Pak for Data
Summary Potential information disclosure vulnerabilities has been identified related toNode.js Elliptic module that may affect IBM watsonx Assistant for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details...
BIT-NODE-MIN-2020-8174
napigetvaluestring allows various kinds of memory corruption in node 10.21.0, 12.18.0, and 14.4.0...
BIT-NODE-MIN-2020-8201
Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...