Most recent entries from all

ALSA-2023:1743 — Important: nodejs:14 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

Security Fix(es):

* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900) * glob-parent: Regular Expression Denial of Service (CVE-2021-35065) * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05189

certfr-2023-avi-0362 — De multiples vulnérabilités ont été découvertes dans IBM. Elles permettent à un attaquant d…

certfr-2023-avi-0362

EUVD-2026-235264

fkie_cve-2022-38900

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

GHSA-w573-4hg7-7wgq — decode-uri-component vulnerable to Denial of Service (DoS)

Affected: npm: decode-uri-component

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

gsd-2022-38900

RHSA-2023:1428 — Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.8 security and bug fix update

gin: Unsanitized input in the default logger in github.com/gin-gonic/gin express: "qs" prototype poisoning causes the hang of the node process http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability ua-parser-js: ReDoS vulnerability via the trim() function loader-utils: Regular expression denial of service decode-uri-component: improper input validation resulting in DoS json5: Prototype Pollution in JSON5 via Parse Method jszip: directory traversal via a crafted ZIP archive

RHSA-2023:1743 — Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

glob-parent: Regular Expression Denial of Service nodejs-minimatch: ReDoS via the braceExpand function c-ares: buffer overflow in config_sortlist() due to missing string length check http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability decode-uri-component: improper input validation resulting in DoS Node.js: Permissions policies can be bypassed via process.mainModule Node.js: insecure loading of ICU data through ICU_DATA environment variable

WID-SEC-W-2023-0424 — Kibana: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Kibana ausnutzen, um einen Denial of Service Angriff durchzuführen.