CVSS: 7.8EPSS: 3%CPEs: 11EXPL: 1CVE-2022-24999 – express: "qs" prototype poisoning causes the hang of the node process
https://notcve.org/view.php?id=CVE-2022-24999
26 Nov 2022 — qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore ... • https://github.com/n8tz/CVE-2022-24999 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0CVE-2014-6393
https://notcve.org/view.php?id=CVE-2014-6393
09 Aug 2017 — The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding. El framework web Express en versiones anteriores a la 3.11 y en versiones 4.x anteriores a la 4.5 para Node.js no proporciona un campo charset en los encabezados HTTP Content-Type en respuestas de nivel 400. Esto permitiría que ataca... • https://bugzilla.redhat.com/show_bug.cgi?id=1203190 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •