Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation

Summary Multiple vulnerabilities in IBM Robotic Process Automation Vulnerability Details CVEID: CVE-2022-0235 DESCRIPTION: Node.js node-fetch could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw when fetching a remote url with Cookie. By sending a...

GHSA-M7XQ-8JP8-RJ2C Command injection in npm-dependency-versions

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

Command injection in npm-dependency-versions

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

payload-plugin-cloud-storage (>=0.0.1, <=1.1.0), payload-plugin-form-builder (1.0.0) potentially affected by CVE-2022-27952 via payload (>=0.8.2, <=0.14.0)

payload NPM version =0.8.2, =0.0.1, =1.1.0 - payload-plugin-form-builder 1.0.0 Source cves: CVE-2022-27952 Source advisory: OSV:GHSA-W8XH-93QH-35VW...

CVE-2022-29080

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

Command injection

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

CVE-2022-29080

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

CVE-2022-29080

The npm-dependency-versions package for Node.js (≤ 0.3.0) is vulnerable to command injection via dependencyVersions called with a JSON object containing a pkgs key and a value with shell metacharacters, enabling arbitrary command execution. Root cause: insufficient input validation on the pkgs fi...

CVE-2022-29080

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

CVE-2022-29080: Improper Neutralization of Special Elements used in an OS Command

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to arbitrary code execution due to CVE-2021-23555

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in a Designer flow. IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to CVE-2021-23555. This bulletin provides patch information ...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to log4js-node CVE-2022-21704

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to log4js-node CVE-2022-21704 with details below Vulnerability Details CVEID: CVE-2022-21704 DESCRIPTION: log4js-node module for Node.js could allow a local authenticated attacker to obtain sensitive...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js with details below Vulnerability Details CVEID: CVE-2021-44533 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect...

edge.js cross-site scripting vulnerability

edge.js is the Node.js template engine. edges.js versions prior to 5.3.2 have a cross-site scripting vulnerability that stems from a type obfuscation vulnerability that can be exploited to bypass input cleanup when the input to be rendered is an array, even if is used, and can be used by attacker...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +7527 more potentially affected by CVE-2021-43138 via async (>=2.0.0, <=2.6.3)

async NPM version =2.0.0, =1.0.1, =2.3.0, =1.0.7, =0.0.1, =0.0.2, =0.0.2, =0.3.0, =0.4.0, =1.2.2 - @36node/template-service 0.3.5 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

@0xcert/ethereum-bitski-backend-provider (>=2.0.0-alpha10, <=2.0.3), @0xcert/ethereum-bitski-frontend-provider (>=2.0.0-alpha10, <=2.0.3) +853 more potentially affected by CVE-2021-43138 via async (>=3.0.0, <=3.2.1)

async NPM version =3.0.0, =2.0.0-alpha10, =2.0.0-alpha10, =4.3.0, =0.0.6-1, =3.6.5, =0.0.73, =1.5.1, =1.7.58, =0.0.1, =1.3.6, =13.0.6, =5.1.1, =1.3.1, =0.0.2-next.4, =0.4.0-next.28 - @ahm-monash/private-test 1.0.0 and more Source cves: CVE-2021-43138 Source advisory: OSV:GHSA-FWR7-V2MV-HH25...

Node.js Memory Use After Free

The vulnerability of the Node.js software platform is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

The Bug Report - March 2022 Edition

The Bug Report - March 2022 By Charles McFarland · April 6, 2022 Your Cybersecurity Comic Relief Comic from https://geek-and-poke.com/ and remains unedited. https://creativecommons.org/licenses/by/3.0/ Use of this comic does not indicate endorsement by the creator. Why am I here? Welcome back the...

The Bug Report - March 2022 Edition

The Bug Report - March 2022 By Charles McFarland · April 6, 2022 Your Cybersecurity Comic Relief Comic from https://geek-and-poke.com/ and remains unedited. https://creativecommons.org/licenses/by/3.0/ Use of this comic does not indicate endorsement by the creator. Why am I here? Welcome back the...

Node.js Resource Management DoS

The vulnerability of the Node.js software platform is related to resource management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...