Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 143

Export CSV
CVE-2024-45590

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Expressjs Openjsf Redhat
Products
Body-parser Body-parser Advanced Cluster Security and 10 more
CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Express Discovery Network Observ Optr and 8 more
CVE-2024-39338

axios: axios: Server-Side Request Forgery

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1 · 4 Medium EPSS 1.2% KEV · Not listed
Vendors
Axios Redhat
Products
Axios Discovery Network Observ Optr and 5 more