GHSA-F2JW-PR2C-9X96 Code injection in @rkesters/gnuplot

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands...

GHSA-C6RQ-RJC2-86V2 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

@jatahworx/bhive-core (>=6.2.0-beta.0, <=7.1.0), aext-scripts (>=0.23.1, <=1.0.7) +6 more potentially affected by CVE-2019-15609 via kill-port-process (2.1.0)

kill-port-process NPM version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on kill-port-process and may be impacted: - @jatahworx/bhive-core =6.2.0-beta.0, =0.23.1, =0.0.1, =0.0.1-test.0, =0.0.30, =0.0.29, =0.0.1, =1.5.0 Source cves: CVE-2019-156...

Signatures are mistakenly recognized to be valid in jsrsasign

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack...

GHSA-H87Q-G2WP-47PJ Signatures are mistakenly recognized to be valid in jsrsasign

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack...

Rocky Linux 8 : nodejs:14 (RLSA-2021:3666)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:3666 advisory. - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host...

AlmaLinux 8 : libuv (ALSA-2021:3075)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:3075 advisory. - Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and...

Node.js 12.x < 12.22.9 / 14.x < 14.18.3 / 16.x < 16.13.2 / 17.x < 17.3.1 Multiple Vulnerabilities (January 10th 2022 Security Releases).

The version of Node.js installed on the remote host is prior to 12.22.9, 14.18.3, 16.13.2, 17.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the January 10th 2022 Security Releases advisory. - Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is...

Node.JS System Information Command Injection (CVE-2021-21315)

A command injection vulnerability exists in Node.JS System Information. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Oracle Linux 8 : nodejs:14 (ELSA-2022-0350)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0350 advisory. nodejs 1:14.18.2-2 - Add missing fixes - Resolves: RHBZ2027642, RHBZ2027635 1:14.18.2-1 - Resolves: RHBZ2027609 - Resolves: RHBZ2027649, RHBZ2027646,...

Moderate: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs:14 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

ALSA-2022:0350 Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.18.2, nodejs-nodemon 2.0.15. BZ2027609 Security Fixes: nodejs-json-schema:...

RLSA-2022:0350 Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.18.2, nodejs-nodemon 2.0.15. BZ2027609 Security Fixes: nodejs-json-schema:...

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.18.2, nodejs-nodemon 2.0.15. BZ2027609 Security Fixes: nodejs-json-schema:...

@webiny/api-page-builder (>=0.0.0-mt-1, <=5.21.0), @webiny/api-page-builder-import-export (>=0.0.0-mt-1, <=5.21.0) +5 more potentially affected by CVE-2021-23484 via zip-local (0.3.4)

zip-local NPM version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on zip-local and may be impacted: - @webiny/api-page-builder =0.0.0-mt-1, =0.0.0-mt-1, =0.0.0-mt-1, =0.0.0-mt-1, =0.0.0-mt-1, =0.1.0, =0.0.2, =0.0.7 Source cves: CVE-2021-23484...

Prototype pollution in min-dash

Impact The set method is vulnerable to prototype pollution with specially crafted inputs. javascript // insert the following into poc.js and run node poc,js after installing the package let parser = require"min-dash"; parser.set, "proto", "polluted", "success"; console.logpolluted; Patches...

PT-2022-7085

Name of the Vulnerable Software and Affected Versions karma versions prior to 6.3.14 Description The issue is related to a Cross-site Scripting XSS - DOM vulnerability in the karma testing emulator for JavaScript code on the Node.js platform. This vulnerability exists due to inadequate protection...

ROS-20220125-10

A vulnerability in the Node.js software platform is related to the formatting logic of the console.table function. Exploitation of the vulnerability could allow an attacker acting remotely to send a special request and assign an empty string to the prototype object's numeric keys A vulnerability ...