Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2021-22939

nodejs: Incomplete validation of tls rejectUnauthorized parameter

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS 3.1 · 5.3 Medium EPSS 14.7% KEV · Not listed
Vendors
Debian Netapp Nodejs and 3 more
Products
Debian Linux Nextgen Api Node.js and 8 more
CVE-2021-22940

nodejs: Use-after-free on close http2 on stream canceling

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Debian Netapp Nodejs and 3 more
Products
Debian Linux Nextgen Api Node.js and 7 more
CVE-2021-22931

nodejs: Improper handling of untypical characters in domain names

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

CVSS 3.1 · 9.8 Critical EPSS 22.0% KEV · Not listed
Vendors
Netapp Nodejs Oracle and 2 more
Products
Active Iq Unified Manager Nextgen Api Oncommand Insight and 10 more
CVE-2021-22930

nodejs: Use-after-free on close http2 on stream canceling

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1 · 9.8 Critical EPSS 36.5% KEV · Not listed
Vendors
Debian Netapp Nodejs and 2 more
Products
Debian Linux Nextgen Api Node.js and 4 more