Количество 24
Количество 24
GHSA-2w6h-7cgj-qw4q
Node.js bad
CVE-2021-22884
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVE-2021-22884
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVE-2021-22884
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVE-2021-22884
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to ...
openSUSE-SU-2021:0389-1
Security update for nodejs8
SUSE-SU-2021:0686-1
Security update for nodejs8
BDU:2021-01895
Уязвимость программной платформы Node.js, связанная с присутствием localhost6 в белом списке, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
openSUSE-SU-2021:0356-1
Security update for nodejs14
SUSE-SU-2021:0650-1
Security update for nodejs14
SUSE-SU-2021:0648-1
Security update for nodejs14
RLSA-2021:0744
Important: nodejs:14 security and bug fix update
RLSA-2021:0735
Important: nodejs:10 security update
RLSA-2021:0734
Important: nodejs:12 security update
ELSA-2021-0744
ELSA-2021-0744: nodejs:14 security and bug fix update (IMPORTANT)
ELSA-2021-0735
ELSA-2021-0735: nodejs:10 security update (IMPORTANT)
ELSA-2021-0734
ELSA-2021-0734: nodejs:12 security update (IMPORTANT)
openSUSE-SU-2021:0372-1
Security update for nodejs10
openSUSE-SU-2021:0357-1
Security update for nodejs12
SUSE-SU-2021:0674-1
Security update for nodejs10
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-2w6h-7cgj-qw4q Node.js bad | CVSS3: 7.5 | 0% Низкий | почти 4 года назад |
 | CVE-2021-22884 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160. | CVSS3: 7.5 | 0% Низкий | около 5 лет назад |
 | CVE-2021-22884 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160. | CVSS3: 7.5 | 0% Низкий | около 5 лет назад |
 | CVE-2021-22884 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160. | CVSS3: 7.5 | 0% Низкий | около 5 лет назад |
| CVE-2021-22884 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to ... | CVSS3: 7.5 | 0% Низкий | около 5 лет назад |
 | openSUSE-SU-2021:0389-1 Security update for nodejs8 | 0% Низкий | около 5 лет назад | |
| SUSE-SU-2021:0686-1 Security update for nodejs8 | 0% Низкий | около 5 лет назад | |
 | BDU:2021-01895 Уязвимость программной платформы Node.js, связанная с присутствием localhost6 в белом списке, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании | CVSS3: 7.5 | 0% Низкий | около 5 лет назад |
| openSUSE-SU-2021:0356-1 Security update for nodejs14 | около 5 лет назад | ||
| SUSE-SU-2021:0650-1 Security update for nodejs14 | около 5 лет назад | ||
| SUSE-SU-2021:0648-1 Security update for nodejs14 | около 5 лет назад | ||
 | RLSA-2021:0744 Important: nodejs:14 security and bug fix update | около 5 лет назад | ||
| RLSA-2021:0735 Important: nodejs:10 security update | около 5 лет назад | ||
| RLSA-2021:0734 Important: nodejs:12 security update | около 5 лет назад | ||
| ELSA-2021-0744 ELSA-2021-0744: nodejs:14 security and bug fix update (IMPORTANT) | около 5 лет назад | ||
| ELSA-2021-0735 ELSA-2021-0735: nodejs:10 security update (IMPORTANT) | около 5 лет назад | ||
| ELSA-2021-0734 ELSA-2021-0734: nodejs:12 security update (IMPORTANT) | около 5 лет назад | ||
| openSUSE-SU-2021:0372-1 Security update for nodejs10 | около 5 лет назад | ||
| openSUSE-SU-2021:0357-1 Security update for nodejs12 | около 5 лет назад | ||
| SUSE-SU-2021:0674-1 Security update for nodejs10 | около 5 лет назад |
Уязвимостей на страницу