Most recent entries from all

bdu:2024-02261

certfr-2024-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0199

EUVD-2026-239672

fkie_cve-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

GHSA-78xj-cgh5-2h22 — NPM IP package incorrectly identifies some private IP addresses as public

Affected: npm: ip

The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.

gsd-2023-42282

msrc_CVE-2023-42282 — The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly cate…

msrc_CVE-2023-42282

RHBA-2024:1440 — Red Hat Bug Fix Advisory: MTV 2.5.6 Images

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests nodejs-ip: arbitrary code execution via the isPublic() function

UBUNTU-CVE-2023-42282

Affected: Ubuntu:Pro:18.04:LTS: node-ip, Ubuntu:Pro:20.04:LTS: node-ip, Ubuntu:Pro:22.04:LTS: node-ip, Ubuntu:24.04:LTS: node-ip

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

WID-SEC-W-2024-0661 — IBM App Connect Enterprise: Schwachstelle ermöglicht Codeausführung und Offenlegung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen und Informationen offenzulegen.