MAL-2022-4692 Malicious code in moodules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4aee60ec70b63c1e0e1054d2f57957ce43110f6a33c58c2d4337296560a5d661 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

deep-defaults vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. Details The NPM module deep-defaults can be abused by Prototype Pollution vulnerability since the function deepDefaults do...

GHSA-2GQW-Q9R9-7F79 Changeset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows attackers to cause a denial of service and may lead to remote code execution. Details The npm module 'changeset' can be abused by Prototype Pollution vulnerability since the function 'apply' does not che...

Changeset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows attackers to cause a denial of service and may lead to remote code execution. Details The npm module 'changeset' can be abused by Prototype Pollution vulnerability since the function 'apply' does not che...

GHSA-Q4XC-7CW8-CGFJ dset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Details The NPM module 'dset' can be abused by Prototype Pollution vulnerability since the function ‘export ' did not check for the...

GHSA-VQ33-26PR-R4H6 flattenizer vulnerable to prototype pollution

Overview Prototype pollution vulnerability in ‘flattenizer’ versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution. Details The NPM module 'flattenizer' can be abused by Prototype Pollution vulnerability since the function 'unflatten' di...

Prototype pollution vulnerability in 'deep-set'

The NPM module 'deep-set' can be abused by Prototype Pollution vulnerability since the function deepSet does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to...

keyget vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution. Details The npm module 'keyget' can be abused by Prototype Pollution vulnerability since the function 'setByPath' did not check f...

OTRS ReDoS Vulnerability (OSA-2021-19)

OTRS is prone to regular expression denial of service ReDoS vulnerability in postcs. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39135

Summary IBM App Connect Enterprise Certified Container Integration Server images may be vulnerable to a symlink attack that could alter the files on disk due to vulnerabilities in the Node module npm. The npm module is not used at runtime by IBM App Connect Enterprise itself, but anyone using the...

Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134

Summary IBM App Connect Enterprise Certified Container Integration Server images may be vulnerable to a symlink attack that could alter the files on disk due to vulnerabilities in the Node module npm. The npm module is not used at runtime by IBM App Connect Enterprise itself, but anyone using the...

Node.js 12.x < 12.22.2 / 14.x < 14.17.2 / 16.x < 16.4.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is prior to 12.22.2, 14.17.2, 16.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2021 Security Releases advisory. - Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii function which is used...

Open Redirect in unshiftio/url-parse

✍️ Description url-parse mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while url-parse sees it as a relative path. Similar attacks:...

July 2021 Security Releases

July 2021 Security Releases Update 1-Jul-2021 Security releases available Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues. libuv upgrade - Out of bounds read Medium CVE-2021-22918 Node.js is vulnerable to out-of-bounds read in libuv's...

Node.js -- July 2021 Security Releases

Node.js reports: libuv upgrade - Out of bounds read Medium CVE-2021-22918 Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii function which is used to convert strings to ASCII. This is called by Node's dns module's lookup function and can lead to information disclosures or...

Server-Side Request Forgery (SSRF) in frenchbread/private-ip

✍️ Description private-ip is an npm module that is used to check if the IP address is private or not for preventing SSRF attacks. It has nearly 11k+ weekly downloads on npmjs. However, I discovered that an attacker may simply get around this check by constructing a malicious IP. 🕵️‍♂️ Proof of...

Unspecified vulnerability in js-extend

js-extend is a module for Npm with extension capabilities. A security vulnerability exists in js-extend versions 0.0.1 through 1.0.1, which can be exploited by an attacker to cause a denial of service and possibly remote code execution...

Server-Side Request Forgery (SSRF) in frenchbread/private-ip

✍️ Description Private-ip is an NPM module that is used to check if the input IP address is private or not, so as to prevent SSRF attacks. It has 12k downloads every week on NPM However, I found that by crafting a malicious IP, an attacker can easily bypass this check. 🕵️‍♂️ Proof of Concept First...

NPM eslint-fixer 命令注入漏洞

npm eslint-fixer is a development module from the American company npm. It provides promise-based functionality that can be applied to a directory or file given by eslint --fix. A command injection vulnerability exists in eslint-fixer version 0.1.5 and earlier versions, which allows commands to b...

CVE-2020-15228

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment...