Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2020-8172, CVE-2020-8174, CVE-2020-11080)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2020-8172, CVE-2020-8174, CVE-2020-11080 Vulnerability Details CVEID: CVE-2020-8172 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. The 'session' event could be emitted before the...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2019-15606, CVE-2019-15604, CVE-2019-15605)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2019-15606, CVE-2019-15604, CVE-2019-15605 Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

Input validation

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

@amazingcat/amazing-iohook (>=8.2.3, <=8.3.3), @donmahallem/trapeze-client-desktop (5.1.1) +15 more potentially affected by CVE-2020-15215 via electron (>=8.0.0, <=8.5.1)

electron NPM version =8.0.0, =8.2.3, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =0.0.1, =1.1.35, =1.1.51 and more Source cves: CVE-2020-15215 Source advisory: OSV:GHSA-56PC-6JQP-XQJ8...

CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...

CVE-2020-24807

The CVE-2020-24807 issue affects the Node.js package socket.io-file up to version 2.0.31. The vulnerability stems from relying on client-side validation of file types, enabling an attacker to upload an executable file by modifying the name field in JSON, potentially leading to arbitrary code exec...

@best/agent-hub (>=7.0.1, <=17.0.0), best (>=7.0.1, <=17.0.0) potentially affected by CVE-2020-24807 via socket.io-file (2.0.31)

socket.io-file NPM version 2.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-file and may be impacted: - @best/agent-hub =7.0.1, =7.0.1, =17.0.0 Source cves: CVE-2020-24807 Source advisory: OSV:GHSA-6495-8JVH-F28X...

[SECURITY] Fedora 33 Update: nodejs-14.11.0-1.fc33

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

PT-2020-15839 · Node.Js · Socket.Io-File

Name of the Vulnerable Software and Affected Versions: socket.io-file versions through 2.0.31 Description: The socket.io-file package for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified...

Fedora: Security Advisory for nodejs (FEDORA-2020-006c7217c4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2020-8203)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2020-8203 Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 fo...

Security Bulletin: A Node.js npm CLI module vulnerability affects IBM® SDK for Node.js™ in IBM Cloud (CVE-2020-15095)

Summary There is a vulnerability which could allow a local attacker to obtain sensitive information in the Node.js npm CLI module that is used in IBM® SDK for Node.js™ in IBM Cloud. Vulnerability Details CVEID: CVE-2020-15095 DESCRIPTION: Node.js npm CLI module could allow a local attacker to...

Security Bulletin: App Connect Enterprise Certified Container is affected by multiple Node.js vulnerabilities

Summary App Connect Enterprise Certified Container is vulnerable to CVE-2020-10531, CVE-2020-11080, CVE-2020-8174, CVE-2020-8172 in Node.js Vulnerability Details CVEID: CVE-2020-11080 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by an error in the HTTP/2 session frame which i...

Security Bulletin: Version 4.17.15 of Node.js module lodash included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability

Summary Security Bulletin: Version 4.17.15 of Node.js module lodash included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See:...

Node.js third-party modules: [zenn-cli] Path traversal on Windows allows the attacker to read arbitrary .md files

Summary I would like to report path traversal in zenn-cli. It allows the attacker to read arbitrary .md files. Module module name: zenn-cli version: 0.1.39 npm page: https://www.npmjs.com/package/zenn-cli Module Description Manage Zenn content locally 👩‍💻 Module Stats 885 weekly downloads...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js (CVE-2020-15095)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js CVE-2020-15095 Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module information disclosure CVSS Base score: 7.5 CVSS Temporal Score: See:...

Security Bulletin: App Connect Enterprise Certified Container is vulnerable to a regular expression infinite loop (NODE-SECURITY-1488)

Summary App Connect Enterprise Certified Container is vulnerable to a regular expression infinite loop that would cause the Designer UI to become unresponsive. Vulnerability Details Third Party Entry: 177309 DESCRIPTION: Node.js acorn module denial of service CVSS Base score: 5.3 CVSS Temporal...

MGASA-2020-0372 Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2019-15605, CVE-2019-15606)

Summary Security vulnerabilities affect IBM Cloud Private Vulnerability Details CVEID: CVE-2019-15605 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attacker could explo...