Skip to content
OpenAdvisories
High WID-SEC-2026-2183 7 CVEs

Red Hat Software Collections: Mehrere Schwachstellen

Published Jun 18, 2020 · Updated Jul 2, 2026 · Revision 2 · de-DE

Vendor: F5 Vendor: Red Hat Product: BIG-IP Product: Enterprise Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Software Collections ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 7

  • Critical 9.8
    CVE-2018-3750

    Prototype Pollution in deep-extend

    The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing p…

    node-deep-extend deep-extend node-deep-extend Debian Ubuntu npm
  • High 7.7
    CVE-2019-16775

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16776

    Unauthorized File Access in npm CLI before before version 6.13.3

    Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow …

    npm cli npm npm Debian Ubuntu npm
  • High 7.7
    CVE-2019-16777

    Arbitrary File Overwrite in npm CLI

    Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a se…

    npm cli npm npm Debian Ubuntu npm
  • High 7.5
    CVE-2017-18077

    ReDoS in brace-expansion

    index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

    brace-expansion node-brace-expansion Debian npm
  • High 7.5
    CVE-2018-3737

    Regular Expression Denial of Service in sshpk

    sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

    HackerOne sshpk node module sshpk node-sshpk Debian Ubuntu npm
  • Low 2.5
    CVE-2017-18869

    Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

    A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

    chownr node-chownr node-chownr Debian Ubuntu npm

Revision history

  1. #2

    Neue Updates von F5 aufgenommen

  2. #1

    Initiale Fassung

References