8886 matches found
nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string
An encoding error flaw exists in the Node.js code that is used to read a peer certificate in the TLS client authentication. An attacker can use this flaw to crash the process used to handle TLS client authentication...
Important: Red Hat Security Advisory: nodejs:10 security update
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ALSA-2020:0579 Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 10.19.0. Security Fixes: nodejs: HTTP request smuggling using malformed...
Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 10.19.0. Security Fixes: nodejs: HTTP request smuggling using malformed...
RLSA-2020:0579 Important: nodejs:10 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 10.19.0. Security Fixes: nodejs: HTTP request smuggling using malformed...
nodejs:10 security update
An update is available for nodejs-nodemon, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform for...
Security Bulletin: Multiple vulnerabilities exist in IBM Planning Analytics Local
Summary Vulnerabilities found in several components have been addressed in IBM Planning Analytics 2.0.5. There are vulnerabilities in IBM® Runtime Environment Java™ Version 7. These issues were disclosed as part of the IBM Java SDK updates in October 2017. Multiple vulnerabilities affect componen...
Fedora 30 : 1:libuv / nghttp2 (2020-47efc31973)
Update to Node.js 12.5.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...
[SECURITY] Fedora 30 Update: nodejs-10.19.0-1.fc30
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...
Moderate Photon OS Security Update - PHSA-2020-0210
Updates of 'nodejs' packages of Photon OS have been released...
Node.js third-party modules: [express-cart] Wide CSRF in application
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report CSRF in...
Node.js: Malformed HTTP/2 SETTINGS frame leads to reachable assert
I do not expect any form of cash bounty for this issue. If we have discovered a unique vulnerability I only ask that Jordan Zebor and Adam Cabrey of F5 Networks be crediting with finding the issue. Summary: A reachable assert in the NodeJS HTTP/2 implementation can result in a denial of service...
Node.js: Slowloris, body parsing
Summary: add summary of the vulnerability Attackers can cause a Denial of Service by sending HTTP request body data extremely slowly to keep a connection open by maintaining activity, and use resources over an extended period. Description: add more details about this vulnerability Body data is se...
RIPS 3.4 Supports Node.js Security Analysis
Node.js Support Over the last year, our engineers worked hard to apply our static code analysis algorithms from Java and PHP to a new JavaScript engine. The result is our third language specific analysis engine which accounts for all code features, characteristics, and flavors of the highly dynam...
Node.js third-party modules: [dy-server2] - stored Cross-Site Scripting
I would like to report Stored XSS in dy-server2 It allows to steal session cookies, deface web , execute anything code javascript Module module name: dy-server2 version: dy-server2 npm page: https://www.npmjs.com/package/dy-server2 Module Description 这是一款轻量级http服务器，可用于文件传输，前端项目预览。 Module Stats...
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer
Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer. IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer have addressed the applicable CVEs. Vulnerability...
Directory traversal
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...
TrendMicro Password Manager node.js Unsafe API Calls
When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup. This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests. It took about 30...
