CVE-2020-8237

A flaw was found in nodejs-json-bigint. A Prototype pollution in json-bigint npm may lead to a denial-of-service DoS attack...

ALPINE-CVE-2020-8252

The implementation of realpath in libuv 10.22.1, 12.18.4, and 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes...

ALPINE-CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

CVE-2020-8251

Node.js 14.11.0 is vulnerable to HTTP denial of service DoS attacks based on delayed requests submission which can make the server unable to accept new connections...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

Information disclosure

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

Summary: CVE-2020-1694 affects Keycloak before 10.0.0 where the NodeJS adapter did not support verify-token-audience, enabling some users to access sensitive information outside their permissions. What’s affected: Keycloak (and Red Hat SSO built on Keycloak) with the NodeJS adapter lacking verify...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-1694: Permissive List of Allowed Inputs

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

PT-2020-14897

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 10.0.0 Description A flaw was found in Keycloak where the NodeJS adapter did not support the verify-token-audience. This results in some users having access to sensitive information outside of their permissions...

@balljs/cli (>=0.0.1, <=0.0.4), @getcronit/pylon-dev (>=1.0.0-beta.1, <=1.0.6) +9 more potentially affected by unknown CVE via treekill (>=0.0.0, <=1.0.0)

treekill NPM version =0.0.0, =0.0.1, =1.0.0-beta.1, =0.0.34, =0.0.9-beta.1, =2.0.0-rc.13, =1.0.1, =1.0.3 Source cves: unknown CVE Source advisory: GHSA-533P-G2HQ-QR26...

alfred-material-manager (>=1.0.0, <=1.0.5) potentially affected by unknown CVE via alfred-workflow-nodejs (2.0.4)

alfred-workflow-nodejs NPM version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on alfred-workflow-nodejs and may be impacted: - alfred-material-manager =1.0.0, =1.0.5 Source cves: unknown CVE Source advisory: SNYK:JS-ALFREDWORKFLOWNODEJS-608975...

Command Injection

Overview alfred-workflow-nodejs is an Alfred workflow nodejs module Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands by using a semicolon char in any of the key values. PoC var AlfredNode = require'alfred-workflow-nodejs'; var util...

Oracle Linux 8 : nodejs:10 (ELSA-2020-0579)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0579 advisory. - Rebase to 10.19.0 to fix CVE-2019-15604 to CVE-2019-15606 - Rebase to 10.16.3 to fix CVE-2019-9511 to CVE-2019-9518 Tenable has extracted the precedi...

Node.js: `fs.realpath.native` on darwin may cause buffer overflow

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: The libuv's implementation of...

grunt-kevoree (>=0.3.0, <=6.0.0-alpha.1), grunt-kevoree-registry (>=3.0.0, <=4.0.0) +9 more potentially affected by CVE-2020-7724 via tiny-conf (1.1.0)

tiny-conf NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tiny-conf and may be impacted: - grunt-kevoree =0.3.0, =3.0.0, =5.7.0-beta.1, =4.0.0-alpha, =5.5.0-alpha, =0.3.0, =1.6.0, =1.0.0-alpha, =1.0.1, =1.0.0, =1.0.2 Source cves:...

Prototype Pollution

Overview tiny-conf is a Node.js configuration with files, environment variables, command-line arguments, ... pluggable architecture in order to work in the browser & server-side Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC const tinyConf =...

Oracle Linux 8 : nodejs:12 (ELSA-2020-2852)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2852 advisory. - Fix CVE-2020-10531 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...