Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 296

Export CSV
CVE-2017-15897

nodejs: Unitialized buffer due to incorrect encoding

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

CVSS 3.1 · 3.1 Low EPSS 2.3% KEV · Not listed
Vendors
Nodejs
Products
Node.js
CVE-2015-3194

OpenSSL: Certificate verify crash with missing PSS parameter

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

CVSS 3.1 · 7.5 High EPSS 44.0% KEV · Not listed
Vendors
Canonical Debian Nodejs and 2 more
Products
Ubuntu Linux Debian Linux Node.js and 3 more
CVE-2014-7191

nodejs-qs: Denial-of-Service Memory Exhaustion

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Nodejs Redhat
Products
Node.js Rhel Software Collections
CVE-2014-5256

V8: Memory Corruption and Stack Overflow

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Nodejs Redhat
Products
Nodejs Rhel Software Collections
CVE-2014-0224

openssl: SSL/TLS MITM vulnerability

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 3.1 · 7.4 High EPSS 95.3% KEV · Not listed
Vendors
Fedoraproject Filezilla-project Mariadb and 6 more
Products
Fedora Filezilla Server Mariadb and 20 more
CVE-2013-6668

v8: multiple vulnerabilities fixed in Google Chrome version 33.0.1750.146

Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 5.6% KEV · Not listed
Vendors
Debian Google Nodejs and 1 more
Products
Debian Linux Chrome V8 and 4 more
CVE-2016-7099

nodejs: wildcard certificates not properly validated

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

CVSS 3.0 · 5.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Nodejs Redhat Suse
Products
Node.js Rhel Software Collections Linux Enterprise
CVE-2016-6306

openssl: certificate message OOB reads

The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.

CVSS 3.1 · 5.9 Medium EPSS 41.7% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more
CVE-2016-6304

openssl: OCSP Status Request extension unbounded memory growth

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

CVSS 3.1 · 7.5 High EPSS 63.0% KEV · Not listed
Vendors
Nodejs Novell Openssl and 1 more
Products
Node.js Suse Linux Enterprise Module For Web Scripting Openssl and 8 more
CVE-2016-6303

openssl: Integer overflow in MDC2_Update()

Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 32.0% KEV · Not listed
Vendors
Nodejs Openssl
Products
Node.js Openssl
CVE-2016-5325

nodejs: reason argument in ServerResponse#writeHead() not properly validated

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

CVSS 3.0 · 6.1 Medium EPSS 4.1% KEV · Not listed
Vendors
Nodejs Redhat Suse
Products
Node.js Openshift Rhel Software Collections and 1 more
CVE-2016-5180

c-ares: Single byte out of buffer write

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

CVSS 3.1 · 9.8 Critical EPSS 8.7% KEV · Not listed
Vendors
C-ares C-ares Project Canonical and 3 more
Products
C-ares C-ares Ubuntu Linux and 3 more
CVE-2016-5172

chromium-browser: arbitrary memory read in v8

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Google Nodejs and 1 more
Products
Debian Linux Chrome Node.js and 1 more
CVE-2016-3956

npm: bearer token leak to non-registry hosts

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

CVSS 3.1 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Ibm Nodejs Npmjs
Products
Sdk Node.js Npm
CVE-2016-2216

nodejs: Response splitting vulnerability using Unicode characters

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Fedoraproject Nodejs
Products
Fedora Node.js
CVE-2016-2178

openssl: Non-constant time codepath followed for certain operations in DSA implementation

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Nodejs and 4 more
Products
Ubuntu Linux Debian Linux Node.js and 7 more
CVE-2016-2107

openssl: Padding oracle in AES-NI CBC MAC check

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

CVSS 3.1 · 5.9 Medium EPSS 89.1% KEV · Not listed
Vendors
Canonical Debian Google and 5 more
Products
Ubuntu Linux Debian Linux Android and 15 more
CVE-2016-2105

openssl: EVP_EncodeUpdate overflow

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

CVSS 3.1 · 7.5 High EPSS 39.6% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Ubuntu Linux Debian Linux and 17 more
CVE-2016-2086

nodejs: Request smuggling vulnerability

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CVSS 3.0 · 7.5 High EPSS 6.3% KEV · Not listed
Vendors
Fedoraproject Nodejs
Products
Fedora Node.js