CVE-2021-22930

nodejs: Use-after-free on close http2 on stream canceling

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1 · 9.8 Critical EPSS 36.5% KEV · Not listed

Vendors

Debian Netapp Nodejs and 2 more

Products

Debian Linux Nextgen Api Node.js and 4 more

CVE-2021-22884

nodejs: DNS rebinding in --inspect

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

CVSS 3.1 · 7.5 High EPSS 36.8% KEV · Not listed

Vendors

Fedoraproject Netapp Nodejs and 3 more

Products

Fedora Active Iq Unified Manager E-series Performance Analyzer and 13 more

CVE-2021-22883

nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

CVSS 3.1 · 7.5 High EPSS 77.4% KEV · Not listed

Vendors

Fedoraproject Netapp Nodejs and 3 more

Products

Fedora E-series Performance Analyzer Node.js and 9 more

CVE-2020-8287

nodejs: HTTP request smuggling via two copies of a header field in an http request

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

CVSS 3.1 · 6.5 Medium EPSS 16.3% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 4 more

CVE-2020-8265

nodejs: use-after-free in the TLS implementation

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

CVSS 3.1 · 8.1 High EPSS 9.1% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 4 more

CVE-2020-8277

c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

CVSS 3.1 · 7.5 High EPSS 54.2% KEV · Not listed

Vendors

C-ares Project Fedoraproject Nodejs and 2 more

Products

C-ares Fedora Node.js and 7 more

CVE-2020-8252

libuv: buffer overflow in realpath

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Nodejs Opensuse and 1 more

Products

Fedora Node.js Leap and 3 more

CVE-2020-8201

nodejs: HTTP request smuggling due to CR-to-Hyphen conversion

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

CVSS 3.1 · 7.4 High EPSS 5.3% KEV · Not listed

Vendors

Fedoraproject Nodejs Opensuse and 1 more

Products

Fedora Node.js Leap and 3 more

CVE-2019-15606

nodejs: HTTP header values do not have trailing optional whitespace trimmed

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1 · 9.8 Critical EPSS 20.0% KEV · Not listed

Vendors

Debian Nodejs Opensuse and 2 more

Products

Debian Linux Node.js Leap and 6 more

CVE-2019-15605

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1 · 9.8 Critical EPSS 57.1% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 13 more

CVE-2019-15604

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1 · 7.5 High EPSS 20.0% KEV · Not listed

Vendors

Debian Nodejs Opensuse and 2 more

Products

Debian Linux Node.js Leap and 9 more

CVE-2022-45381

jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline Utility Steps Openshift

CVE-2022-45380

jenkins-plugin/JUnit: Stored XSS vulnerability in JUnit Plugin

Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Junit Openshift

CVE-2023-23920

Node.js: insecure loading of ICU data through ICU_DATA environment variable

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Nodejs Redhat

Products

Debian Linux Node.js Enterprise Linux and 2 more

CVE-2023-23919

Node.js: OpenSSL error handling issues in nodejs crypto library

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Enterprise Linux

CVE-2022-43548

nodejs: DNS rebinding in inspect via invalid octal IP address

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

CVSS 3.1 · 8.1 High EPSS 14.9% KEV · Not listed

Vendors

Debian Nodejs Redhat

Products

Debian Linux Node.js Enterprise Linux and 2 more

CVE-2022-35255

nodejs: weak randomness in WebCrypto keygen

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

CVSS 3.1 · 9.1 Critical EPSS 2.1% KEV · Not listed

Vendors

Debian Nodejs Redhat and 1 more

Products

Debian Linux Node.js Enterprise Linux and 1 more

CVE-2019-14865

grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Enterprise Linux Eus and 2 more

CVE-2022-4055

xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Freedesktop Redhat

Products

Xdg-utils Enterprise Linux

CVE-2022-4116

quarkus_dev_ui: Dev UI Config Editor is vulnerable to drive-by localhost attacks leading to RCE

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 32.5% KEV · Not listed

Vendors

Quarkus Redhat

Products

Quarkus Build Of Quarkus Quarkus