DEBIAN-CVE-2023-30581

The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...

CVE-2023-30581: Missing Authorization

The use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time...

Friday October 13 2023 Security Releases

Friday October 13 2023 Security Releases Update 13-October-2023 Security releases available Updates are now available for the v18.x and v20.x Node.js release lines for the following issues. undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch Low - CVE-2023-45143 Undic...

CVE-2023-30589

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

Crlf injection

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

CVE-2023-30589

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

Malicious code in internallib_v20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8995744ac960b2796119f9301b2b1be09d18c9770d313656d10e25f7dce49434 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-9244

HUAWEI Mate 20 versions Versions earlier than 10.1.0.160C00E160R3P8;HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270C431E7R1P5,Versions earlier than 10.1.0.270C635E3R1P5,Versions earlier than 10.1.0.273C636E7R2P4;HUAWEI Mate 20 X versions Versions earlier than...

CVE-2020-9527

Firmware developed by Shenzhen Hichip Vision Technology V6 through V20, after 2018-08-09 through 2020, as used by many different vendors in millions of Internet of Things devices, suffers from buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code via...

CVE-2020-9529

Firmware developed by Shenzhen Hichip Vision Technology V6 through V20, as used by many different vendors in millions of Internet of Things devices, suffers from a privilege escalation vulnerability that allows attackers on the local network to reset the device's administrator password. This...

Huawei Honor V20 Information Disclosure Vulnerability (CNVD-2020-27123)

Huawei Honor V20 is a smartphone from Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Honor V20 versions prior to 10.0.0.179 C636E3R4P3, prior to 10.0.0.180 C185E3R3P3, and prior to 10.0.0.180 C432E10R3P4, which stems from a program that does not adequately...

CVE-2020-1803

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...

CVE-2020-1803

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...

Information disclosure

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...

CVE-2020-1803

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...

CVE-2020-1803

CVE-2020-1803 affects Huawei Honor V20 devices. Affected versions are earlier than 10.0.0.179 (C636E3R4P3) and earlier than 10.0.0.180 (C185E3R3P3, C432E10R3P4). The root cause is insufficient validation of the identity of a connected smart wearable device in specific scenarios, enabling informat...

CVE-2020-1803: Improper Authentication

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179C636E3R4P3,versions earlier than 10.0.0.180C185E3R3P3,versions earlier than 10.0.0.180C432E10R3P4 have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in...

PT-2020-15075

Name of the Vulnerable Software and Affected Versions Honor V20 versions prior to 10.0.0.179C636E3R4P3 Honor V20 versions prior to 10.0.0.180C185E3R3P3 Honor V20 versions prior to 10.0.0.180C432E10R3P4 Description The issue is related to insufficient validation of the identity of smart wearable...

CVE-2019-5228

Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193C00E190R1P21, Versions earlier than VOGUE-AL00A 9.1.0.193C00E190R1P12, Versions earlier than Princeton-AL10B 9.1.0.233C00E233R4P3 have a race condition vulnerability. The system does not...

Race condition

Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193C00E190R1P21, Versions earlier than VOGUE-AL00A 9.1.0.193C00E190R1P12, Versions earlier than Princeton-AL10B 9.1.0.233C00E233R4P3 have a race condition vulnerability. The system does not...