Most recent entries from all

ALSA-2021:0548 — Moderate: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

* libuv: buffer overflow in realpath (CVE-2020-8252)

* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

* nodejs-dot-prop: prototype pollution (CVE-2020-8116)

* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

* npm: sensitive information exposure through logs (CVE-2020-15095)

* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02883

certfr-2022-avi-278 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum discover. Certaines d'entre elles permettent à un att…

certfr-2022-avi-278

cnvd-2020-22045

EUVD-2026-38048

fkie_cve-2020-7608

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

GHSA-p9pc-299p-vxgp — yargs-parser Vulnerable to Prototype Pollution

Affected: npm: yargs-parser

Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.

## Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.

gsd-2020-7608

RHSA-2020:5305 — Red Hat Security Advisory: rh-nodejs12-nodejs security update

nodejs-yargs-parser: prototype pollution vulnerability nodejs-y18n: prototype pollution vulnerability c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

RHSA-2020:5499 — Red Hat Security Advisory: nodejs:12 security and bug fix update

UBUNTU-CVE-2020-7608

Affected: Ubuntu:18.04:LTS: node-yargs-parser

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

WID-SEC-W-2022-2133 — JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten

JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.