Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Joyent Node.js npm 安全漏洞
Vulnerability Description
Joyent Node.js是美国Joyent公司的一套建立在Google V8 JavaScript引擎之上的网络应用平台。npm是其中的一个包管理和分发工具。 Joyent Node.js中使用的npm 2.15.1之前版本和3.8.3之前3.x版本中的CLI中存在安全漏洞，该漏洞源于请求中包含发件人令牌。远程攻击者可通过读取Authorization头利用该漏洞获取敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A