Denial Of Service (DoS)

restify-paginate is vulnerable to denial of service. An attacker is able to crash the application by omitting the HTTP Host header in the HTTP request...

CVE-2020-27543

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2020-27543

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

Design/Logic Flaw

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2020-27543

CVE-2020-27543 affects the restify-paginate package for Node.js (version 0.0.5). The vulnerability allows remote attackers to cause a Denial of Service by omitting the HTTP Host header, leading a Restify-based service to crash with an uncaught exception. Connected advisories (including Red Hat, G...

CVE-2020-27543

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2020-27543

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

CVE-2020-27543: Improper Handling of Exceptional Conditions

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception...

PT-2021-11405

Name of the Vulnerable Software and Affected Versions: restify-paginate version 0.0.5 Description: The issue allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header, resulting in a Restify-based web service crashing with an uncaught exception. Recommendations: For...

Paul Varache restify-paginate security vulnerability

Paul Varache restify-paginate is a Paul Varache open source application. A middleware that helps navigation between pages. A security vulnerability in restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a denial of service by ignoring HTTP host headers...

GHSA-GVFF-25CC-4F66 Path Traversal in restify-swagger-jsdoc

Versions of restify-swagger-jsdoc prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths. Recommendation Upgrade to version 3.2.1 or later...

Path Traversal in restify-swagger-jsdoc

Versions of restify-swagger-jsdoc prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths. Recommendation Upgrade to version 3.2.1 or later...

PT-2020-21319

Name of the Vulnerable Software and Affected Versions restify-swagger-jsdoc versions prior to 3.2.1 Description The issue arises from the package's failure to properly sanitize URLs, potentially allowing attackers to access server files outside the swagger-ui folder by using relative paths...

Node.js: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Summary: Node.js is vulnerable to HTTP denial of service DOS attacks based on delayed requests submission which can make the server unable to accept new connections. Description: An attacker can open an arbitrary number of HTTP connections and keep the server busy by never completing the request...

GHSA-QW3G-35HC-FCRH Cross-Site Scripting (XSS) in restify

Affected versions of restify are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL. Proof of Concept: Request https://localhost:3000/no5such3file7.pl?%22%3E%3Cscript%3Ealert73541;%3C/script%3E Will be included in response: alert73541;...

3c (>=0.0.1-alpha, <=1.0.0), @loklaan/npm-hook-slack (>=1.0.1, <=1.1.0-testing.2) +311 more potentially affected by CVE-2017-16018 via restify (>=2.1.1, <=4.0.4)

restify NPM version =2.1.1, =0.0.1-alpha, =1.0.1, =0.1.2, =0.2.5, =0.1.9, =0.0.1, =0.2.20, =0.3.7, =2.0.0, =1.0.1, =0.0.0, =0.0.1, =0.0.1, =0.5.1 and more Source cves: CVE-2017-16018 Source advisory: GHSA-QW3G-35HC-FCRH...

Cross-Site Scripting (XSS) in restify

Affected versions of restify are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL. Proof of Concept: Request https://localhost:3000/no5such3file7.pl?%22%3E%3Cscript%3Ealert73541;%3C/script%3E Will be included in response: alert73541;...

3c (>=0.0.1-alpha, <=1.0.0), @loklaan/npm-hook-slack (>=1.0.1, <=1.1.0-testing.2) +311 more potentially affected by CVE-2017-16018 via restify (>=2.1.1, <=4.0.4)

restify NPM version =2.1.1, =0.0.1-alpha, =1.0.1, =0.1.2, =0.2.5, =0.1.9, =0.0.1, =0.2.20, =0.3.7, =2.0.0, =1.0.1, =0.0.0, =0.0.1, =0.0.1, =0.5.1 and more Source cves: CVE-2017-16018 Source advisory: OSV:GHSA-QW3G-35HC-FCRH...

Private Data Disclosure in express-restify-mongoose

Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the following User...

GHSA-CGJX-MWPX-47JV Private Data Disclosure in express-restify-mongoose

Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the following User...