Security Bulletin: Vulnerabilities in OpenSSL affect Rational Software Architect and Rational Software Architect for WebSphere Software (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by Rational Software Architect and Rational Software Architect for WebSphere Software. The applicable CVEs have been addressed. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSS...

Security Bulletin: Multiple OpenSSL and Non-OpenSSL vulnerabilities have been identified in IBM SDK for Node.js included in Rational Software Architect and Rational Software Architect for WebSphere Software

Summary IBM SDK for Node.js shipped with Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software .OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js ha...

Security Bulletin: OpenSSL vulnerabilities in Node.js found on May 03, 2016 affect Rational Software Architect and Rational Software Architect for WebSphere Software (CVE-2016-2107, CVE-2016-2105)

Summary OpenSSL vulnerabilities were disclosed on May 03, 2016 by the OpenSSL Project. OpenSSL is used by Rational Software Architect and Rational Software Architect for WebSphere Software. The applicable CVEs have been addressed. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL...

Security Bulletin: Multiple vulnerabilities affecting the Cordova platform and IBM SDK Node.js packaged with Rational Software Architect and Rational Software Architect for WebSphere Software

Summary Multiple vulnerabilities have been discovered that affect the Cordova platform and IBM SDK Node.js packaged with Rational Software Architect and Rational Software Architect for WebSphere software CVE-2014-3500, CVE-2014-3501, CVE-2014-3502, CVE-2014-5256, CVE-2014-7191, CVE-2014-7192,...

Node.js -- September 2020 Security Releases

Node.js reports: Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion High CVE-2020-8201 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing...

@alinex/checkup (>=0.7.0, <=1.2.2), @alinex/server (>=0.8.8, <=1.0.0) +52 more potentially affected by unknown CVE via unflatten (1.0.4)

unflatten NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on unflatten and may be impacted: - @alinex/checkup =0.7.0, =0.8.8, =1.2.0-alpha1, =0.1.0, =0.1.0, =0.0.1, =0.0.8, =1.0.13, =0.0.2, =0.0.3, =1.0.0, =1.0.1, =1.1.0, =1.1.0, =1.3.7...

GHSA-V6GV-FG46-H89J Sensitive Data Exposure in put

All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of...

Sensitive Data Exposure in put

All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of...

Node.js third-party modules: [curling] Remote Code Execution

I would like to report RCE in curling I can bypass the security check for special characters, read / overwrite file Module module name: curling version: 1.1.0 npm page: https://www.npmjs.com/package/curling Module Description A node wrapper for curl with a very simple api. Module Stats 156 weekly...

Node.js third-party modules: [imagickal] Remote Code Execution

I would like to report RCE in imagickal It allows to execute arbitrary commands on the victim's PC Module module name: imagickal version: 4.2.0 npm page: https://www.npmjs.com/package/imagickal Module Description node wrapper for ImageMagick commands Module Stats 42 weekly downloads Vulnerability...

GHSA-G3QW-9PGP-XPJ4 Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

Out-of-bounds Read in njwt

Versions of njwt prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the base64urlEncode function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability. Recommendation Upgrade...

GHSA-RVG8-PWQ2-XJ7Q Out-of-bounds Read in base64url

Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. Recommendation Update to version 3.0.0 or later...

Out-of-bounds Read in base64url

Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. Recommendation Update to version 3.0.0 or later...

Remote Memory Disclosure in bittorrent-dht

Versions of bittorrent-dht prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory. There are two mitigating factors here, that slightly reduce...

GHSA-77G4-36JP-5V3M Remote Memory Disclosure in bittorrent-dht

Versions of bittorrent-dht prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory. There are two mitigating factors here, that slightly reduce...

Node.js third-party modules: [arpping] Remote Code Execution

I would like to report RCE in arpping It allows to execute arbitrary commands on the victim's PC Module module name: arpping version: 2.0.0 npm page: https://www.npmjs.com/package/arpping Module Description Discover and search for internet-connected devices locally using ping and arp Module Stats...

@w3sec/goof (1.1.0), door (>=0.0.5, <=0.0.6) +5 more potentially affected by CVE-2014-3744 via st (>=0.0.12, <=0.2.4)

st NPM version =0.0.12, =0.0.5, =1.0.0, =0.0.0, =0.0.0-a10, =0.1.0, =0.0.1, =0.0.12 Source cves: CVE-2014-3744 Source advisory: OSV:GHSA-69RR-WVH9-6C4Q...

group-lunches (>=0.0.2, <=0.0.10), lets-chat-ldap (>=0.1.0, <=0.4.0) +5 more potentially affected by CVE-2015-7294 via ldapauth-fork (2.2.19)

ldapauth-fork NPM version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on ldapauth-fork and may be impacted: - group-lunches =0.0.2, =0.1.0, =0.0.2, =0.1.0, =0.0.0, =0.0.1 Source cves: CVE-2015-7294 Source advisory: OSV:GHSA-82MG-X548-GQ3J...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js modules

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains vulnerable versions of Node.js modules. Vulnerability Details CVEID: CVE-2019-15138 DESCRIPTION: Node.js html-pdf module could allow a remote attacker to obtain sensitive information, caused by improper input validation. By sending ...