Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2848▼ 157 respecto a la semana anterior
Críticas / altas1375▲ 58 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)266▼ 258 respecto a la semana anterior
3 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 2.5% | — | Salesforce Tough-cookie | 1/7/2023 | 17/6/2026 | Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. | |
| Modificada | Media (5.3) | 2.4% | — | Salesforce Tough-cookieIBM API ConnectRedhat Openshift Container Platform | 5/9/2018 | 17/6/2026 | NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. | |
| Modificada | Alta (7.5) | 3.3% | — | Salesforce Tough-cookie | 4/10/2017 | 17/6/2026 | A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. |