https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:25:56 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00718 bdu:2026-00718 https://cve.radiocsirt.org/vuln/bdu:2026-00718 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1119 certfr-2022-avi-1119 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1119 https://cve.radiocsirt.org/vuln/euvd-2026-258339 EUVD-2026-258339 https://cve.radiocsirt.org/vuln/euvd-2026-258339 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24785 <p>Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.</p> <p>Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24785 https://cve.radiocsirt.org/vuln/ghsa-8hfj-j24r-96c4 <p><strong>Affected:</strong> npm: moment, NuGet: Moment.js</p> <p>### Impact This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.</p> <p>### Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).</p> <p>### Workarounds Sanitize user-provided locale name before passing it to moment.js.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [moment repo](https://github.com/moment/moment)</p> <p><strong>Affected:</strong> npm: moment, NuGet: Moment.js</p> <p>### Impact This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.</p> <p>### Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).</p> <p>### Workarounds Sanitize user-provided locale name before passing it to moment.js.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [moment repo](https://github.com/moment/moment)</p> https://cve.radiocsirt.org/vuln/ghsa-8hfj-j24r-96c4 https://cve.radiocsirt.org/vuln/gsd-2022-24785 gsd-2022-24785 https://cve.radiocsirt.org/vuln/gsd-2022-24785 https://cve.radiocsirt.org/vuln/rhsa-2022:1681 <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> https://cve.radiocsirt.org/vuln/rhsa-2022:1681 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24785 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: nikola, Ubuntu:Pro:16.04:LTS: node-moment, Ubuntu:18.04:LTS: node-moment, Ubuntu:20.04:LTS: node-moment, Ubuntu:22.04:LTS: node-moment</p> <p>Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: nikola, Ubuntu:Pro:16.04:LTS: node-moment, Ubuntu:18.04:LTS: node-moment, Ubuntu:20.04:LTS: node-moment, Ubuntu:22.04:LTS: node-moment</p> <p>Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24785 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0288 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0288