Количество 37
Количество 37
ROS-20240808-03
Уязвимость nodejs
ELSA-2024-1444
ELSA-2024-1444: nodejs:16 security update (IMPORTANT)
CVE-2024-21892
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-21892
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-21892
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-21892
CVE-2024-21892
On Linux, Node.js ignores certain environment variables if those may h ...
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run a ...
GHSA-f27j-4f6g-jp27
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
BDU:2024-01672
Уязвимость программной платформы Node.js, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
GHSA-xfgw-qcmv-354j
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
BDU:2024-02819
Уязвимость функции PrivateDecrypt() криптографической библиотеки программной платформы Node.js, позволяющая нарушителю реализовать атаку Блейхенбахера (Bleichenbacher) или атаку Марвина (Marvin)
ROS-20240812-08
Уязвимость nodejs
ROS-20240916-04
Уязвимость nodejs
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | ROS-20240808-03 Уязвимость nodejs | CVSS3: 7.5 | 0% Низкий | 12 месяцев назад |
| ELSA-2024-1444 ELSA-2024-1444: nodejs:16 security update (IMPORTANT) | больше 1 года назад | ||
 | CVE-2024-21892 On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges. | CVSS3: 7.8 | 0% Низкий | больше 1 года назад |
 | CVE-2024-21892 On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges. | CVSS3: 8.1 | 0% Низкий | больше 1 года назад |
 | CVE-2024-21892 On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges. | CVSS3: 7.8 | 0% Низкий | больше 1 года назад |
 | CVSS3: 7.8 | 0% Низкий | больше 1 года назад | |
| CVE-2024-21892 On Linux, Node.js ignores certain environment variables if those may h ... | CVSS3: 7.8 | 0% Низкий | больше 1 года назад |
| CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. | CVSS3: 7.4 | 1% Низкий | 11 месяцев назад |
| CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. | CVSS3: 5.9 | 1% Низкий | больше 1 года назад |
| CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. | CVSS3: 7.4 | 1% Низкий | 11 месяцев назад |
| CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run a ... | CVSS3: 7.4 | 1% Низкий | 11 месяцев назад |
| GHSA-f27j-4f6g-jp27 On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges. | CVSS3: 7.5 | 0% Низкий | больше 1 года назад |
 | BDU:2024-01672 Уязвимость программной платформы Node.js, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями | CVSS3: 8.8 | 0% Низкий | больше 1 года назад |
| GHSA-xfgw-qcmv-354j Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. | CVSS3: 7.4 | 1% Низкий | 11 месяцев назад |
| BDU:2024-02819 Уязвимость функции PrivateDecrypt() криптографической библиотеки программной платформы Node.js, позволяющая нарушителю реализовать атаку Блейхенбахера (Bleichenbacher) или атаку Марвина (Marvin) | CVSS3: 5.9 | 1% Низкий | больше 1 года назад |
| ROS-20240812-08 Уязвимость nodejs | CVSS3: 8.8 | 0% Низкий | 12 месяцев назад |
| ROS-20240916-04 Уязвимость nodejs | CVSS3: 5.9 | 1% Низкий | 11 месяцев назад |
Уязвимостей на страницу