Blockchain Platform

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Published: 2021-04-13T06:50:12.000Z
Updated: 2024-08-03T22:02:51.887Z

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

Published: 2021-06-01T12:28:09.000Z
Updated: 2024-08-03T18:58:26.413Z

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Published: 2020-11-19T00:32:13.000Z
Updated: 2025-04-30T22:24:27.745Z

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Published: 2020-07-15T16:10:27.000Z
Updated: 2024-08-04T09:56:28.214Z

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

Published: 2020-07-24T21:45:37.000Z
Updated: 2024-08-04T09:56:26.828Z