Most recent entries from all

ALSA-2021:0548 — Moderate: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

* libuv: buffer overflow in realpath (CVE-2020-8252)

* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

* nodejs-dot-prop: prototype pollution (CVE-2020-8116)

* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

* npm: sensitive information exposure through logs (CVE-2020-15095)

* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02874

certfr-2022-avi-510 — De multiples vulnérabilités ont été découvertes dans IBM QRadar. Certaines d'entre elles permettent à un attaquant de p…

certfr-2022-avi-510

EUVD-2026-176554

fkie_cve-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

GHSA-qqgx-2p2h-9c37 — ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Affected: npm: ini

### Overview The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.

### Patches

This has been patched in 1.3.6.

### Steps to reproduce

payload.ini ``` [__proto__] polluted = "polluted" ```

poc.js: ``` var fs = require('fs') var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8')) console.log(parsed) console.log(parsed.__proto__) console.log(polluted) ```

``` > node poc.js {} { polluted: 'polluted' } { polluted: 'polluted' } polluted ```

gsd-2020-7788

OESA-2022-1769 — nodejs security update

Affected: openEuler:20.03-LTS-SP1: nodejs, openEuler:20.03-LTS-SP3: nodejs

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-39…

RHSA-2021:0421 — Red Hat Security Advisory: rh-nodejs14-nodejs security update

nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS nodejs-y18n: prototype pollution vulnerability nodejs-ini: Prototype pollution via malicious INI file nodejs: use-after-free in the TLS implementation c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS nodejs: HTTP request smuggling via two copies of a header field in an http request nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

RHSA-2021:0548 — Red Hat Security Advisory: nodejs:10 security update

nodejs-yargs-parser: prototype pollution vulnerability nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS nodejs-y18n: prototype pollution vulnerability nodejs-ini: Prototype pollution via malicious INI file nodejs-dot-prop: prototype pollution libuv: buffer overflow in realpath nodejs: use-after-free in the TLS implementation nodejs: HTTP request smuggling via two copies of a header field in an http request npm: sensitive information exposure through logs nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

UBUNTU-CVE-2020-7788

Affected: Ubuntu:14.04:LTS: node-ini, Ubuntu:16.04:LTS: node-ini, Ubuntu:18.04:LTS: node-ini, Ubuntu:20.04:LTS: node-ini, Ubuntu:22.04:LTS: node-ini, Ubuntu:24.04:LTS: node-ini, Ubuntu:25.10: node-ini, Ubuntu:26.04:LTS: node-ini

WID-SEC-W-2022-1603 — IBM Tivoli Netcool/OMNIbus: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Netcool/OMNIbus ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.