Security Vulnerabilities - CVEs Published In May 2018
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-05-31
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
CVSS Score
7.5
EPSS Score
0.006
Published
2018-05-31
Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-05-31
Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.
CVSS Score
7.5
EPSS Score
0.01
Published
2018-05-31
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
CVSS Score
5.3
EPSS Score
0.002
Published
2018-05-31
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
CVSS Score
5.3
EPSS Score
0.001
Published
2018-05-31
ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-05-31
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
CVSS Score
7.5
EPSS Score
0.004
Published
2018-05-31
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-05-31
jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
CVSS Score
7.5
EPSS Score
0.003
Published
2018-05-31