Vulnerabilities > Nodejs

DATE CVE VULNERABILITY TITLE RISK
2017-12-07 CVE-2017-3738 Information Exposure vulnerability in multiple products
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli.
network
high complexity
openssl debian nodejs CWE-200
5.9
2017-10-30 CVE-2017-14919 Improper Input Validation vulnerability in Nodejs Node.Js
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
network
low complexity
nodejs CWE-20
7.5
2017-10-23 CVE-2014-3744 Path Traversal vulnerability in Nodejs Node.Js
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
network
low complexity
nodejs CWE-22
7.5
2017-10-10 CVE-2015-7384 Resource Exhaustion vulnerability in Nodejs Node.Js 4.0.0/4.1.0/4.1.1
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
network
low complexity
nodejs CWE-400
7.5
2017-09-28 CVE-2017-14849 Path Traversal vulnerability in Nodejs Node.Js 8.5.0
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
network
low complexity
nodejs CWE-22
7.5
2017-09-20 CVE-2015-2927 Resource Management Errors vulnerability in multiple products
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
network
low complexity
uronode nodejs debian CWE-399
6.5
2017-07-25 CVE-2017-11499 Improper Input Validation vulnerability in Nodejs Node.Js
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js.
network
low complexity
nodejs CWE-20
7.5
2017-07-07 CVE-2017-1000381 Information Exposure vulnerability in multiple products
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
network
low complexity
c-ares-project c-ares nodejs CWE-200
7.5
2017-05-23 CVE-2016-9843 The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
network
low complexity
zlib opensuse debian canonical oracle redhat apple netapp mariadb nodejs
critical
9.8
2017-05-23 CVE-2016-9842 The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. 8.8