CVE-2021-27884

The vulnerability CVE-2021-27884 affects YMFE YApi up to version 1.9.2, where JWT signing secret is generated using Math.random() in Node.js. This weak randomness allows an attacker to recreate other users’ JWTs by exploiting predictable secret generation. Connected advisories (GHSA-2H3H-VW8R-82R...

CVE-2021-27884

Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...

Regular expression Denial of Service in @progfay/scrapbox-parser

Impact A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js. The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU. Patches Upgrade to version 6.0.3,...

GHSA-9FHW-R42P-5C7R Regular expression Denial of Service in @progfay/scrapbox-parser

Impact A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js. The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU. Patches Upgrade to version 6.0.3,...

URIjs Hostname spoofing via backslashes in URL

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash \ character as part of the scheme delimiter, e.g. scheme:/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and...

Exploit for OS Command Injection in Systeminformation

CVE-2021-21315-systeminformation This is Proof of Concept for...

Debian DSA-4863-1 : nodejs - security update

Two vulnerabilities were discovered in Node.js, which could result in denial of service or DNS rebinding attacks. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4863. The text itself is copyright C Software ...

MGASA-2021-0092 Updated nodejs packages fix security vulnerabilities

Two vulnerabilities were discovered in Node.js, which could result in denial of service or DNS rebinding attacks. Upgrade from Mageia 7 to 8 problem fixed...

Updated nodejs packages fix security vulnerabilities

Two vulnerabilities were discovered in Node.js, which could result in denial of service or DNS rebinding attacks. Upgrade from Mageia 7 to 8 problem fixed...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector. CVSS Base score: ...

CVE-2021-21298

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via t...

CVE-2021-21297

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default...

Design/Logic Flaw

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21298 via @node-red/runtime (>=1.0.0, <=1.2.7)

@node-red/runtime NPM version =1.0.0, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21298 Source advisory: OSV:GHSA-M33V-338H-4V9F...

@dolittle/node-red (>=2.0.0, <=2.2.8), @dolittle/node-red-infor-m3 (>=2.0.0, <=2.2.8) +13 more potentially affected by CVE-2021-21297 via @node-red/runtime (>=1.0.0, <=1.2.7)

@node-red/runtime NPM version =1.0.0, =2.0.0, =2.0.0, =7.0.0, =1.2.0, =0.1.1, =1.0.0-beta.1, =0.0.1, =0.0.3, =0.0.5, =0.0.2, =1.0.4, =1.0.1, =1.0.2 Source cves: CVE-2021-21297 Source advisory: OSV:GHSA-XP9C-82X8-7F67...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251)

Summary IBM Cloud Private is vulnerable to Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this...

Vulnerabilities fixed in Node.js

Node.js developers have fixed vulnerabilities. The vulnerabilities allow an unauthorized remote malicious person to remote user to cause a denial-of-service and to bypass a security measure. -= Debian =- Debian has made updates to nodejs available for to address the vulnerabilities. You can insta...

Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)

Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...