Most recent entries from all

9AKK108470A8565 — RMC-100 Vulnerability in the Web UI (REST Interface)

An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.

ALSA-2023:0050 — Moderate: nodejs:14 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).

Security Fix(es):

* minimist: prototype pollution (CVE-2021-44906) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999) * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2023-avi-0276 — De multiples vulnérabilités ont été découvertes dans IBM. Elles permettent à un attaquant d…

certfr-2023-avi-0276

EUVD-2026-235584

fkie_cve-2022-24999

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

GHSA-hrpp-h998-j3pp — qs vulnerable to Prototype Pollution

Affected: npm: qs

qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

gsd-2022-24999

ICSA-25-084-01 — ABB RMC-100

msrc_CVE-2022-24999 — qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang fo…

msrc_CVE-2022-24999

OESA-2024-1338 — nodejs-qs security update

Affected: openEuler:22.03-LTS-SP3: nodejs-qs

This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others. Security Fix(es): qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).(CVE-2022-24999)

RHSA-2023:0050 — Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor nodejs-minimatch: ReDoS via the braceExpand function express: "qs" prototype poisoning causes the hang of the node process nodejs: DNS rebinding in inspect via invalid octal IP address

RHSA-2023:0612 — Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

glob-parent: Regular Expression Denial of Service minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor nodejs-minimatch: ReDoS via the braceExpand function express: "qs" prototype poisoning causes the hang of the node process nodejs: DNS rebinding in inspect via invalid octal IP address

UBUNTU-CVE-2022-24999

Affected: Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-qs

WID-SEC-W-2023-0398 — Red Hat Advanced Cluster Management for Kubernetes: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Red Hat Advanced Cluster Management for Kubernetes ausnutzen, um einen Denial of Service Angriff durchzuführen.