01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +3847 more potentially affected by CVE-2022-24999 via qs (>=6.5.0, <=6.5.2)

qs NPM version =6.5.0, =1.0.0, =0.2.0, =0.1.0, =1.0.0, =1.0.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =6.0.0, =1.0.0, =2.2.5 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...

@211la/search-client (>=0.1.0, <=0.5.0), @2bad/bitrix (>=2.0.0, <=2.3.0) +15 more potentially affected by CVE-2022-24999 via qs (6.8.0)

qs NPM version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on qs and may be impacted: - @211la/search-client =0.1.0, =2.0.0, =0.0.0-GO-1036-new-endpoint-to-download-bulk-details.3, =9.1.23-alpha2.60, =0.6.4, =2.1.1, =0.1.0, =3.4.5, =1.0.0, =0.1....

22ndtech-angular-lib (>=0.0.7, <=0.0.57), 3loc (>=0.2.0, <=0.4.0) +2954 more potentially affected by CVE-2022-24999 via qs (>=6.0.0, <=6.2.3)

qs NPM version =6.0.0, =0.0.7, =0.2.0, =0.1.53, =5.1.0, =2.0.1, =1.1.0, =0.1.0, =0.3.1, =5.1.0, =0.0.0, =2.1.0, =2018.7.11-0, =2018.10.8-2 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...

@aothechbcn/frontend-idealbar--lib-idealbar (>=1.0.0, <=1.0.10), @brigad/redux-rest-easy (>=3.0.0, <=3.0.3) +55 more potentially affected by CVE-2022-24999 via qs (6.6.0)

qs NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on qs and may be impacted: - @aothechbcn/frontend-idealbar--lib-idealbar =1.0.0, =3.0.0, =0.92.0, =1.0.1, =1.0.0, =5.1.0, =13.1.1-5e9b77d, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 -...

@bouzuya/mr-jums (>=0.2.0, <=0.9.1), @deansel/latte (0.1.2-beta.1) +77 more potentially affected by CVE-2022-24999 via qs (>=6.3.0, <=6.3.1)

qs NPM version =6.3.0, =0.2.0, =1.0.0-alpha.7, =0.0.1-alpha.1, =0.0.1-dev.0, =4.0.0-beta.6, =3.0.0, =0.20.5, =0.20.5, =0.20.8, =0.1.5, =0.6.5, =0.13.0, =0.15.0 - app-decorators 0.8.206 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...

CVE-2022-24999

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...

AZL-44307 CVE-2022-24999 affecting package nodejs-nodemon 2.0.3-5

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string ...

Security Bulletin: qs (QueryString) package in the Service Portal of IBM Control Desk is vulnerable (CVE-2014-7191 and CVE-2017-1000048)

Summary As per the BlackDuck Scan, there is one package qs QueryString which is vulnerable in the Service Portal. The qs QueryString package is coming from multer modules installed as npm package. Vulnerability Details CVEID:CVE-2014-7191 DESCRIPTION: Node.js is vulnerable to a denial of service,...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary RamdaCVE-2021-42581 is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forgeCVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-772...

Crow 安全漏洞

Crow is a C++ microframework for running web services. A security vulnerability exists in Crow v1.0+4, which stems from a buffer overflow discovered via the qsparse function. An attacker could exploit this vulnerability to cause a Denial of Service DoS via specially crafted input...

MAL-2022-5559 Malicious code in qs-state-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9da71ad932749ac1913fcb6cb4136c1ff886b10688974cc061dcdc2de8aebd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qs-state-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9da71ad932749ac1913fcb6cb4136c1ff886b10688974cc061dcdc2de8aebd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-44906 DESCRIPTION: Node.js Minimist module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution in setKey...

python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters

The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request...

qs-optiker.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1185790 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

@bouzuya/mr-jums (>=0.2.0, <=0.9.1), @deansel/latte (0.1.2-beta.1) +77 more potentially affected by CVE-2017-1000048 via qs (>=6.3.0, <=6.3.1)

qs NPM version =6.3.0, =0.2.0, =1.0.0-alpha.7, =0.0.1-alpha.1, =0.0.1-dev.0, =4.0.0-beta.6, =3.0.0, =0.20.5, =0.20.5, =0.20.8, =0.1.5, =0.6.5, =0.13.0, =0.15.0 - app-decorators 0.8.206 and more Source cves: CVE-2017-1000048 Source advisory: OSV:GHSA-GQGV-6JQ5-JJJ9...

Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing or may bypass the prototype pollution protection and alt...

GHSA-GQGV-6JQ5-JJJ9 Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing or may bypass the prototype pollution protection and alt...

@aconex/styleguide (>=2.0.1, <=2.2.0), @acornfamily/site (>=1.1.0, <=1.3.0) +1348 more potentially affected by CVE-2017-1000048 via qs (>=6.2.0, <=6.2.1)

qs NPM version =6.2.0, =2.0.1, =1.1.0, =0.1.0, =0.0.0, =0.7.15, =0.0.0, =1.0.23, =1.0.10, =3.3.91, =0.0.0, =0.1.0, =1.2.17, =0.5.6, =0.5.7 and more Source cves: CVE-2017-1000048 Source advisory: OSV:GHSA-GQGV-6JQ5-JJJ9...

@jurajkubelka/wiki (>=0.9.4, <=0.9.6), bolt-leecher (1.0.1) +8 more potentially affected by CVE-2017-1000048 via qs (>=6.0.0, <=6.0.2)

qs NPM version =6.0.0, =0.9.4, =0.0.12, =1.0.3, =0.1.0-alpha.0, =0.9.4, =0.9.0-beta.1, =0.9.3 - wiki-security-persona 0.1.2 Source cves: CVE-2017-1000048 Source advisory: OSV:GHSA-GQGV-6JQ5-JJJ9...