Moment
Monthly
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.