Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 149

Export CSV
CVE-2019-10773

nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Redhat Yarnpkg
Products
Quay Yarn
CVE-2019-10205

quay: Red Hat Quay stores robot account tokens in plain text

A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Quay
CVE-2019-1010266

lodash: uncontrolled resource consumption in Data handler causing denial of service

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Lodash Redhat
Products
Lodash Quay
CVE-2018-3774

nodejs-url-parse: incorrect hostname in url parsing

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

CVSS 3.1 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Quay Url-parse
CVE-2018-3728

hoek: Prototype pollution in utilities function

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

CVSS 3.0 · 8.8 High EPSS 4.2% KEV · Not listed
Vendors
Hapijs Redhat
Products
Hoek Mobile Application Platform Quay
CVE-2018-3721

lodash: Prototype pollution in utilities function

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Lodash Netapp Redhat
Products
Lodash Active Iq Unified Manager System Manager and 1 more
CVE-2018-21270

nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Nodejs Redhat
Products
Node.js Quay
CVE-2018-1107

nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Is-my-json-valid Project Redhat
Products
Is-my-json-valid Quay
CVE-2018-16492

nodejs-extend: Prototype pollution can allow attackers to modify object properties

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Extend Project Redhat
Products
Extend Quay