VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

Výsledky hledání

zdroj: Microsoft Security× v celém archivu zrušit filtry

2906 karet z 2906 položek · strana 48 z 49 CZ · EN/orig

2

2

5

1

3

2

1

CVE-2026-21717 A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Information published.

EPSS 0.00 CVE-2026-21717 US

Microsoft Security ·

1

1

2

1

2

1

1

1

1

1

1

1

1

1

5

5

CVE-2007-3205 The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.

Information published.

EPSS 0.02 CVE-2007-3205 PHP Hardened-PHP Suhosin US

Microsoft Security ·

15

CVE-2025-23167 A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Information published.

EPSS 0.01 CVE-2025-23167 Node.js US

Microsoft Security ·

CVE-2024-22018 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Information published.

EPSS 0.00 CVE-2024-22018 Node.js US

Microsoft Security ·

1

1

1