CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-1628
https://notcve.org/view.php?id=CVE-2021-1628
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021. MuleSoft es consciente de una vulnerabilidad de XML External Entity (XXE) que afecta a determinadas versiones de un componente runtime de Mule que puede afectar tanto a los clientes de CloudHub como a los clientes locales. Versiones afectadas: runtime de Mule versiones 4.x lanzado antes del 2 de febrero de 2021. • https://help.salesforce.com/articleView?id=000357384&type=1&mode=1 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-1627
https://notcve.org/view.php?id=CVE-2021-1627
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021. MuleSoft es consciente de una vulnerabilidad de Server Side Request Forgery que afecta a determinadas versiones de un componente runtime de Mule que puede afectar tanto a los clientes de CloudHub como a los locales. Esto afecta a: runtime de Mule versiones 3.8.x,3.9.x,4.x lanzado antes del 2 de febrero de 2021. • https://help.salesforce.com/articleView?id=000357383&type=1&mode=1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-1626
https://notcve.org/view.php?id=CVE-2021-1626
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021. MuleSoft es consciente de una vulnerabilidad de Ejecución de Código Remota que afecta a determinadas versiones de un componente runtime de Mule que puede afectar tanto a CloudHub como a los clientes locales. Versiones afectadas: runtime de Mule versiones 4.1.x y 4.2.x lanzado antes del 2 de febrero de 2021. • https://help.salesforce.com/articleView?id=000357382&type=1&mode=1 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2017-15010 – nodejs-tough-cookie: Regular expression denial of service
https://notcve.org/view.php?id=CVE-2017-15010
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. Se detectó una vulnerabilidad de denegación de servicio con expresiones regulares (ReDoS) en el módulo tough-cookie en versiones anteriores a la 2.3.3 para Node.js. Un atacante que sea capaz de realizar una petición HTTP utilizando una cookie especialmente manipulada podría hacer que la aplicación consuma una cantidad excesiva de recursos de CPU. A regular expression denial of service flaw was found in Tough-Cookie. • https://github.com/ossf-cve-benchmark/CVE-2017-15010 http://www.securityfocus.com/bid/101185 https://access.redhat.com/errata/RHSA-2017:2912 https://access.redhat.com/errata/RHSA-2017:2913 https://access.redhat.com/errata/RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1264 https://github.com/salesforce/tough-cookie/issues/92 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT https://nodesecurity.io/advisories&# • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2016-1000232 – nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
https://notcve.org/view.php?id=CVE-2016-1000232
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. NodeJS Tough-Cookie 2.2.2 contiene una vulnerabilidad de análisis de expresiones regulares en el análisis de la cabecera de cookie de petición HTTP que puede resultar en una denegación de servicio (DoS). Este ataque parece ser explotable mediante una cabecera HTTP personalizada pasada por el cliente. • https://access.redhat.com/errata/RHSA-2016:2101 https://access.redhat.com/errata/RHSA-2017:2912 https://access.redhat.com/security/cve/cve-2016-1000232 https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232 https://www.npmjs.c • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •