8889 matches found
TrendMicro Password Manager node.js Unsafe API Calls
When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup. This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests. It took about 30...
CVE-2013-7381
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify...
Code injection
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify...
CVE-2013-7381
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify...
CVE-2013-7381
CVE-2013-7381 affects libnotify before 1.0.4 when used with Node.js. The root cause is input passed to libnotify.notify allowing shell/command injection, enabling remote command execution. Affected component: libnotify (Node.js binding), version pre-1.0.4. Impact per sources: potential arbitrary ...
CVE-2013-7381
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify...
CVE-2013-7381
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify...
CVE-2013-7378
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...
CVE-2013-7378
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...
Command injection
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...
CVE-2013-7378
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands...
CVE-2013-7378
CVE-2013-7378 affects hubot-scripts: the email.coffee script in hubot-scripts (Node.js) prior to version 2.4.4 allows remote command execution due to a command-injection flaw in hubot-scripts/package/src/scripts/email.coffee. Impact is high (remote attacker could run arbitrary commands). Affected...
Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA
Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA. IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA have addressed the applicable CVEs. Vulnerability Details Refer to the security bulletinss listed in the...
Node.js third-party modules: Server-Side Request Forgery (SSRF) in Ghost CMS
I would like to report about SSRF vulnerability in CMS Ghost blog It allows attacker able to send a crafted GET request from a vulnerable web application Module module name: ghost version: 3.5.2 npm page: https://www.npmjs.com/package/ghost website page https://ghost.org/ Module Description Ghost...
Joyent Node.js Input Validation Error Vulnerability
Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...
[SECURITY] Fedora 31 Update: nodejs-12.15.0-1.fc31
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...
Node.js third-party modules: [hangersteak] Web Server Directory Traversal via Crafted GET Request
I would like to report path traversal in hangersteak module. It allows an attacker to read system files via path traversal local/remote Module module name: hangersteak version: 0.2.4 latest npm page: https://www.npmjs.com/package/hangersteak Module Description Node web static files server with...
Node.js third-party modules: [sirloin] Web Server Directory Traversal via Crafted GET Request
I would like to report path traversal in Sirloin module. It allows an attacker to read system files via path traversal local/remote Module module name: Sirloin version: 0.15.0 latest release build npm page: https://www.npmjs.com/package/sirloin Module Description This high performance, extremely...
