Node.js — программная платформа, основанная на движке V8 (компилирующем JavaScript в машинный код)
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 24.22.2 | 24.22.2 | ||
| 24.22.1 | 24.22.1 | ||
| 24.22.0 | 24.22.0 | ||
| 24.21.0 | 24.21.0 | ||
| 24.20.0 | 24.20.0 | ||
| 24.19.0 | 24.19.0 | ||
| 24.18.1 | 24.18.1 | ||
| 24.18.0 | 24.18.0 | ||
| 24.17.0 | 24.17.0 | ||
| 24.16.0 | 24.16.0 |
Показывать по
Количество 1 296
CVE-2015-5380
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
CVE-2015-5380
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.
CVE-2015-0278
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
CVE-2015-0278
libuv before 0.10.34 does not properly drop group privileges, which al ...
CVE-2015-0278
libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
CVE-2015-8855
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVE-2015-8860
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
BDU:2022-01720
Уязвимость программной платформы Node.js, связанная с ошибками управления ресурсом, позволяющая нарушителю вызвать отказ в обслуживании
CVE-2014-7192
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
CVE-2014-7192
Eval injection vulnerability in index.js in the syntax-error package b ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2015-5380 The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence. | CVSS2: 7.5 | 3% Низкий | больше 11 лет назад |
 | CVE-2015-5380 The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence. | CVSS2: 4.3 | 3% Низкий | больше 11 лет назад |
 | CVE-2015-0278 libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors. | CVSS2: 10 | 3% Низкий | больше 11 лет назад |
| CVE-2015-0278 libuv before 0.10.34 does not properly drop group privileges, which al ... | CVSS2: 10 | 3% Низкий | больше 11 лет назад |
| CVE-2015-0278 libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors. | CVSS2: 10 | 3% Низкий | больше 11 лет назад |
| CVE-2015-8855 The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)." | CVSS2: 4.3 | 7% Низкий | больше 11 лет назад |
| CVE-2015-8860 The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive. | CVSS2: 4.3 | 4% Низкий | больше 11 лет назад |
 | BDU:2022-01720 Уязвимость программной платформы Node.js, связанная с ошибками управления ресурсом, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 4% Низкий | почти 12 лет назад |
| CVE-2014-7192 Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file. | CVSS2: 10 | 13% Средний | почти 12 лет назад |
| CVE-2014-7192 Eval injection vulnerability in index.js in the syntax-error package b ... | CVSS2: 10 | 13% Средний | почти 12 лет назад |
Уязвимостей на страницу