134 results · Feed
-
Unscored —
Timing attack against ECDSA signature generation
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.…
-
Unscored —
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js unde…
-
Unscored —
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of s…
-
Unscored —
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Servi…
-
Unscored —
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) v…
-
Unscored —
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such a…
-
Unscored —
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform rem…
-
High 7.5CVE-2018-1000168 EPSS 11%
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC f…
-
Unscored —
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill val…
-
Unscored —
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake fa…
-
Unscored —
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (unc…
-
Unscored —
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read m…
-
Unscored —CVE-2016-5180 Public exploit
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cau…
-
Unscored —
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objec…