CVE-2021-22960

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

GHSA-MC7W-4CJF-C973 OS Command Injection in node-opencv

utils/find-opencv.js in node-opencv aka OpenCV bindings for Node.js prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands...

@finsemble/finsemble-electron-adapter (>=5.4.0, <=6.0.0), @innomind/studio (>=2.5.16, <=2.6.38) +19 more potentially affected by CVE-2021-39184 via electron (>=11.0.0, <=11.4.9)

electron NPM version =11.0.0, =5.4.0, =2.5.16, =0.0.7-beta, =0.0.9-poc, =3.0.0, =0.18.1, =0.32.0-alpha.47, =0.3.280, =1.0.0, =0.3.0, =4.0.1, =2.6.30, =2.6.42 - katex-screenshot 1.4.1 and more Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

@domoskanonos/nidoca-pwa (>=1.0.1, <=1.0.2), @finsemble/finsemble-electron-adapter (>=6.1.0-beta.20210707, <=6.2.1) +9 more potentially affected by CVE-2021-39184 via electron (>=13.0.1, <=13.2.3)

electron NPM version =13.0.1, =1.0.1, =6.1.0-beta.20210707, =0.26.3, =0.0.8, =0.0.1, =3.0.2, =1.3.17, =0.0.7, =2.0.29, =3.11.4, =5.4.2 - simple-git-gui 3.7.14 Source cves: CVE-2021-39184 Source advisory: OSV:GHSA-MPJM-V997-C4H4...

Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise v11 & v12 (CVE-2021-22930)

Summary IBM App Connect Enterprise v11 & v12 ship with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-22930 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions,...

Node.js -- October 2021 Security Releases

Node.js reports: HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. HTTP Request Smuggling when parsing the body MediumCVE-2021-22960 The...

October 12th 2021 Security Releases

October 12th 2021 Security Releases Update 12-Oct-2021 Security releases available Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues. HTTP Request Smuggling due to spaced in headers MediumCVE-2021-22959 The http parser accepts requests with a...

Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-3757

Summary IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution via CVE-2021-3757. This only affects App Connect Designers Vulnerability Details CVEID: CVE-2021-3757 DESCRIPTION: Node.js immer module could allow a remote attacker to execute arbitrary code on t...

Node.js 12.x < 12.22.4, 14.x < 14.17.4, 16.x < 16.6.0 Use After Free Vulnerability - Mac OS X

Node.js is prone to a use after free vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Node.js 12.x < 12.22.4, 14.x < 14.17.4, 16.x < 16.6.0 Use After Free Vulnerability - Windows

Node.js is prone to a use after free vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescriptio...

Security Bulletin: Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251, CVE-2020-8277)

Summary Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities. Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attack...

DEBIAN-CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

UBUNTU-CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134

Summary IBM App Connect Enterprise Certified Container Integration Server images may be vulnerable to a symlink attack that could alter the files on disk due to vulnerabilities in the Node module npm. The npm module is not used at runtime by IBM App Connect Enterprise itself, but anyone using the...

Security Bulletin: IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to CVE-2021-23362 and CVE-2021-27290

Summary IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to regular expression DoS vulnerabilities in the Node module npm. The npm module is not used at runtime by IBM App Connect Enterprise itself, but anyone using the certified containers ...

CVE-2021-22930

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...

CVE-2021-22930: Use After Free

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...