Filtered by vendor Openjsf Subscriptions
Filtered by product Express Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-24999 4 Debian, Openjsf, Qs Project and 1 more 12 Debian Linux, Express, Qs and 9 more 2024-11-21 7.5 High
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
CVE-2014-6393 1 Openjsf 1 Express 2024-11-21 N/A
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
CVE-2024-10491 2 Expressjs, Openjsf 2 Express, Express 2024-11-07 4 Medium
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
CVE-2024-43796 2 Openjsf, Redhat 9 Express, Network Observ Optr, Openshift Data Foundation and 6 more 2024-09-20 5 Medium
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.