CVE search results

41 – 50 of 183 results

Detailed view

Sort by:

CVE-2023-30585

Medium priority

Ignored

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation,...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2023-30581

Medium priority

Ignored

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2023-5678

Low priority

Some fixes available 8 of 20

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Fixed	Fixed
openssl1.0	Not in release	Not in release	Not in release	Fixed	Not in release

CVE-2023-5363

Medium priority

Some fixes available 5 of 8

Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Not affected	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected	Not in release

CVE-2023-39332

Medium priority

Not affected

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	—	Not affected	Not affected	Not affected	Not affected

CVE-2023-39331

Medium priority

Needs evaluation

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-38552

Medium priority

Needs evaluation

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node’s policy implementation, thus...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-44487

High priority

Some fixes available 18 of 55

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

13 affected packages

dotnet6, dotnet7, dotnet8, h2o, haproxy...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
dotnet6	Not in release	Fixed	Not in release	Not in release	Not in release
dotnet7	Not in release	Fixed	Not in release	Not in release	Not in release
dotnet8	Fixed	Not affected	Not in release	Not in release	Not in release
h2o	Not affected	Needs evaluation	Needs evaluation	Needs evaluation	Not in release
haproxy	Not affected	Not affected	Not affected	Fixed	Not affected
netty	Not affected	Fixed	Fixed	Not affected	Not affected
nghttp2	Not affected	Fixed	Fixed	Fixed	Fixed
nginx	Not affected	Not affected	Not affected	Not affected	Not affected
nodejs	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tomcat10	Not affected	Not in release	Not in release	Ignored	Ignored
tomcat8	Not in release	Not in release	Not in release	Needs evaluation	Needs evaluation
tomcat9	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Ignored
trafficserver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2023-32558

Medium priority

Ignored

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Not affected	Not affected	Not affected	Not affected	Not affected

CVE-2023-32005

Medium priority

Ignored

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that...

1 affected package

nodejs

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
nodejs	Not affected	Not affected	Not affected	Not affected	Not affected

Export to JSON

Results by page:

Search CVE reports