CentOS 9 : nodejs-nodemon-2.0.20-2.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the nodejs- nodemon-2.0.20-2.el9 build changelog. - Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95. CVE-2021-44906 Note that Nessus has...

CentOS 9 : nodejs-16.16.0-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the nodejs-16.16.0-1.el9 build changelog. - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs...

CentOS 9 : nodejs-nodemon-2.0.20-3.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the nodejs- nodemon-2.0.20-3.el9 build changelog. - The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular...

PT-2024-5241 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: Node.js versions 18.x, 20.x, and 21.x Description: The issue is related to the improper handling of batch files in child process.spawn and child process.spawnSync on Windows platforms. This allows a malicious command line argument to inject...

SUSE-SU-2024:0644-1 Security update for nodejs18

This update for nodejs18 fixes the following issues: Update to 18.19.1: security updates CVE-2024-21892: Code injection and privilege escalation through Linux capabilities bsc1219992. CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks...

SUSE-SU-2024:0643-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: Update to 20.11.1: security updates CVE-2024-21892: Code injection and privilege escalation through Linux capabilities bsc1219992. CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks...

On Linux Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

...

Malicious code in nodejs-socket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6faf2af3d2f96a941eb439231cffcfa446dffe36c83cc9bf7f68107239ab4e9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-35048 CVE-2024-25629 affecting package nodejs for versions less than 20.14.0-1

c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded...

AZL-34462 CVE-2024-25629 affecting package nodejs18 for versions less than 18.20.2-1

c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded...

OESA-2024-1171 nodejs security update

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser. Security Fixes: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the...

Mageia: Security Advisory (MGASA-2024-0046)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service

nodejs:sid is vulnerable to Denial Of Service. The vulnerability is due to the HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, this server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

Timing Side Channel Attack

NodeJS is vulnerable to Timing Side Channel Attack. The vulnerability is caused due to a defect in privateDecrypt API of the crypto library during PKCS1 v1.5 padding error handling where there is a significant timing differences in decryption for valid and invalid ciphertexts. An attackers can...

CVE-2023-7245

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

CVE-2023-7245

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

Code injection

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

CVE-2023-7245

OpenVPN Connect contains a local arbitrary-code execution vulnerability (CVE-2023-7245) in the nodejs/Electron runtime context. Affected: OpenVPN Connect 3.0–3.4.3 on Windows and 3.0–3.4.7 on macOS. Root cause: improper configuration of the nodejs environment, enabling ELECTRON_RUN_AS_NODE to exe...

CVE-2023-7245

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

AZL-34461 CVE-2024-22019 affecting package nodejs18 for versions less than 18.20.2-1

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...