13238 matches found
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to string injection vulnerability due to Node.js (CVE-2021-44532, CVE-2021-44532 )
Summary String injection vulnerabilities in Node.js - CVE-2021-44532, CVE-2021-44532, has been identified that affects IBM Watson Assistant for IBM Cloud Pak for Data. Node.js is used as cross-platform runtime environment by IBM Watson Assistant for IBM Cloud Pak for Data. The fix includes versio...
Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)
Summary Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js. Vulnerability Details CVEID:CVE-2021-44531 DESCRIPTION: Node.js cou...
Vendure Cross-Site Scripting Vulnerability
Vendure is a headless GraphQL eCommerce framework based on Node.js and Nest ļ¼ TypeScript, focused on developer productivity and easy customization. version 0.1.0-alpha.2 to 1.5.1 of Vendure is vulnerable to a cross-site scripting vulnerability that stems from the program's lack of data validation...
CVE-2022-29166
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain fro...
Design/Logic Flaw
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain fro...
CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain fro...
CVE-2022-29166
CVE-2022-29166 affects matrix-appservice-irc (Node.js IRC bridge). The underlying issue in node-irc allows an attacker to make a Matrix user execute IRC commands by replying to a maliciously crafted message. A patch is available in matrix-appservice-irc 0.33.2. Guidance in disclosures urges not t...
CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain fro...
Improper handling of multiline messages in node-irc
node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of...
GHSA-52RH-5RPJ-C3W6 Improper handling of multiline messages in node-irc
node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of...
Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
GHSA-QP2Q-6H9J-JG2R Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
OpenSSL update assessment, and Node.js project plans
OpenSSL update assessment, and Node.js project plans Summary The OpenSSL Security releases of May 3 2022 affects Node.js 17.x and 18.x but highest severity is "Low" Analysis Our assessment of the security advisory is: The crehash script allows command injection CVE-2022-1292 Node.js doesn't use o...
Security Bulletin: IBM Robotic Process Automation is vulnerable to a denial of service through node.js lodash
Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to a denial of service through node.js lodash Vulnerability Details CVEID:CVE-2019-10744 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a...
Security Bulletin: IBM Robotic Process Automation may be vulnerable to an exposure of sensitive information by an unauthorized actor through follow-redirects (CVE-2022-0536)
Summary Security Bulletin: IBM Robotic Process Automation may be vulnerable to an exposure of sensitive information by an unauthorized actor through follow-redirects CVE-2022-0536 Vulnerability Details CVEID: CVE-2022-0536 DESCRIPTION: Node.js follow-redirects module could allow a remote...
CVE-2022-30241
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
Input validation
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
CVE-2022-30241
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...