Most recent entries from all

ALSA-2020:5499 — Moderate: nodejs:12 security and bug fix update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)

* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)

bdu:2021-01024

Withdrawn: BELL-CVE-2020-8277 — CVE-2020-8277 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2020-8277

Affected: Bitnami: node

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

certfr-2021-avi-065 — De multiples vulnérabilités ont été découvertes dans les produits Stormshield. Elles permettent à un attaquant de provo…

certfr-2021-avi-065

Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-236159

fkie_cve-2020-8277

GHSA-m5pg-8h68-j225 — Uncontrolled Resource Consumption in node

gsd-2020-8277

msrc_CVE-2020-8277 — A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…

msrc_CVE-2020-8277

OESA-2021-1099 — c-ares security update

Affected: openEuler:20.03-LTS: c-ares, openEuler:20.03-LTS-SP1: c-ares

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple. Security Fix(es): A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.(CVE-2020-8277)

openSUSE-SU-2020:2045-1 — Security update for c-ares

Security update for c-ares

RHSA-2020:5305 — Red Hat Security Advisory: rh-nodejs12-nodejs security update

nodejs-yargs-parser: prototype pollution vulnerability nodejs-y18n: prototype pollution vulnerability c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

SUSE-SU-2020:3478-1 — Security update for c-ares

Security update for c-ares

WID-SEC-W-2023-0065 — Oracle MySQL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Verfügbarkeit, Vertraulichkeit und Integrität zu gefährden.