CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9266 – Open Redirect
https://notcve.org/view.php?id=CVE-2024-9266
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0. • https://www.herodevs.com/vulnerability-directory/cve-2024-9266 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47178 – basic-auth-connect's callback uses time unsafe string comparison
https://notcve.org/view.php?id=CVE-2024-47178
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0. • https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203 https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw • CWE-208: Observable Timing Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45590 – body-parser vulnerable to denial of service when url encoding is enabled
https://notcve.org/view.php?id=CVE-2024-45590
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3. A flaw was found in body-parser. This vulnerability causes denial of service via a specially crafted payload when the URL encoding is enabled. • https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7 https://access.redhat.com/security/cve/CVE-2024-45590 https://bugzilla.redhat.com/show_bug.cgi?id=2311171 • CWE-405: Asymmetric Resource Consumption (Amplification) •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43800 – serve-static affected by template injection that can lead to XSS
https://notcve.org/view.php?id=CVE-2024-43800
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. serve-static sirve archivos estáticos. serve-static pasa información de usuario no confiable (incluso después de sanearla) a redirect() y puede ejecutar código no confiable. Este problema se solucionó en serve-static 1.16.0. A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect(). • https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p https://access.redhat.com/security/cve/CVE-2024-43800 https://bugzilla.redhat.com/show_bug.cgi?id=2311154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-43796 – express vulnerable to XSS via response.redirect()
https://notcve.org/view.php?id=CVE-2024-43796
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0. Express.js, el framework web minimalista para Node. En Express anterior a la versión 4.20.0, pasar una entrada de usuario no confiable (incluso después de desinfectarla) a response.redirect() puede ejecutar código no confiable. • https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553 https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx https://access.redhat.com/security/cve/CVE-2024-43796 https://bugzilla.redhat.com/show_bug.cgi?id=2311152 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •