CVE-2019-15138

The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL...

CVE-2019-15138

CVE-2019-15138 affects the Node.js module html-pdf (v2.2.0). The vulnerability allows an arbitrary file read by processing an HTML file that uses an XMLHttpRequest to access a file:/// URL, enabling the server to exfiltrate local files (e.g., /etc/passwd). Public references in the Connected docum...

Security Bulletin: Node.js as used in IBM QRadar Packet Capture is vulnerable to the following CVE's (CVE-2019-1559, CVE-2019-5737, CVE-2019-5739)

Summary Node.js as used in IBM QRadar Packet Capture is susceptible to the following vulnerabilities Vulnerability Details CVEID: CVE-2019-1559 Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after t...

Node.js third-party modules: Path traversal using symlink

I would like to report Path Traversal in statics-server Module module name: statics-server version: 0.0.9 npm page: https://www.npmjs.com/package/statics-server Module Description npm install statics-server -g Go to the folder you want to statics-server Run the server statics-server Module Stats...

Node.js third-party modules: [snekserve] Stored XSS via filenames HTML formatted

I would like to report a stored XSS issue in the snekserve module. It allows to inject HTML/JS code inside the directory listing : Module module name: snekserve version: 1.0.0 npm page: https://www.npmjs.com/package/snekserve Module Description Assuming you would like to serve a static site, sing...

Node.js third-party modules: [create-git] RCE via insecure command formatting

The create-git NPM module was vulnerable against command injection which was possible since some user supplied inputs were concatenated without proper checks inside a exec call, which made possible executing arbitrary commands besides the git one which is used by the tool. The PoC resulted in: js...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and Spectrum LSF Explorer

Summary There are multiple vulnerabilities in Node.js used by IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA and Spectrum LSF Explorer. Vulnerability Details CVE-ID: CVE-2019-9511 Description: Multiple vendors are vulnerable to a denial of service, caused by a Data Dribble attack. By...

Node.js third-party modules: [expressjs-ip-control] Whitelist IP bypass leads to authorization bypass and sensitive info disclosure

I would like to report a unauthenticated access/authorization bypass issue in the expressjs-ip-control module. It allows to bypass the whitelist IP check in order to bypass the authorization check and possibly expose sensitive datas. Module module name: MODULE NAME version: MODULE VERSION npm pag...

OpenSSL security releases do not require Node.js security releases

OpenSSL security releases do not require Node.js security releases Summary The OpenSSL Security releases of September 10th, 2019 do not affect Node.js. Analysis Our assessment of the security advisory is: ECDSA remote timing attack CVE-2019-1547 Not affected. Node supports only named curves for...

@angstone/microservice (>=0.0.0, <=0.0.3), @nodeframe/seneca (>=2.1.0, <=2.2.20) +11 more potentially affected by CVE-2019-5483 via seneca (>=3.1.0, <=3.7.0)

seneca NPM version =3.1.0, =0.0.0, =2.1.0, =0.4.4, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =1.7.9, =1.8.5 - seneca-in-practice 0.2.0 - seneca-kue 0.1.1-alpha.1 - seneca-telldus-live 0.1.0 - tfk-seneca-seeiendom-lookup 1.0.17 Source cves: CVE-2019-5483 Source advisory: OSV:GHSA-2XWV-3CC9-FP7C...

Node.js third-party modules: Path traversal in https://www.npmjs.com/package/http_server via symlink

I would like to report Path traversal in httpserver It allows an attacker to read arbitrary system files. Module module name: httpserver version: 1.0.12 npm page: https://www.npmjs.com/package/httpserver Module Description Copy description from npm page Module Stats Weekly downloads: 35...

Node.js third-party modules: [reveal.js] XSS by calling arbitrary method via postMessage

I would like to report XSS in reveal.js It allows gaining access to the victim's account and performing actions on his behalf Module module name: reveal.js version: 3.8.0 npm page: https://www.npmjs.com/package/reveal.js Module Description A framework for easily creating beautiful presentations...

Node.js third-party modules: OS Command Injection on Jison [all-parser-ports]

I would like to report OS Command Injection vulnerability on Jison in parser ports. CSharp, PHP It allows arbitrary OS shell command execution through a crafted command-line argument. Basic Information Module: jison Version: 0.4.18 NPM Project Page: https://www.npmjs.com/package/jison Module...

Security Bulletin: A vulnerability in Node.js affects IBM Cloud App Management V2018

Summary There is a vulnerability in Node.js used by IBM® Cloud App Management V2018. Node.js is vulnerable to a denial of service. By establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly to force the connection and associated resources to stay alive for a lo...

USN-4123-1: npm/fstream vulnerability

It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesystem...

CVE-2019-15954: Total.js CMS 12 Widget Remote Code Execution

Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things IoT, etc. Total.js CMS is a Content Management System application that is part of the Total.js framework. A commercial version is also available, and can be seen use...

OpenSSL security releases may require Node.js security releases

OpenSSL security releases may require Node.js security releases Summary The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL. Please read on for full details. OpenSSL The OpenSSL project announced...

Node.js third-party modules: Trojan:JS/CoinMiner in npm files

Hello, I am a front end developer and use Vue.js and Visual Studio Code and have had an issue recently with scripts not running in my terminal so decided to fault find. All programmes that I can think of are up to date, and today I decided to do a full windows defender scan and found the above...

Node.js third-party modules: gitlabhook OS Command Injection

I would like to report OS Command Injection in gitlabhook. It allows execution of arbitrary code on the remote server, that waits for instructions from gitlab. Module module name: gitlabhook version: 0.0.17 npm page: https://www.npmjs.com/package/gitlabhook Module Description This is an easy to u...

The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and the Node.js software platform. This allows attackers to induce service failures.

The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Apache Traffic Server web servers, H2O web servers, network programming tools such as netty, SwiftNIO, Envoy, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting...