Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by nicolas-van

    CVE-2021-41167 (GCVE-0-2021-41167)

    Vulnerability from nvd – Published: 2021-10-20 18:25 – Updated: 2024-08-04 02:59
    VLAI
    Title
    Unlimited requests in modern-async
    Summary
    modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    References
    Impacted products
    Vendor Product Version
    nicolas-van modern-async Affected: < 1.0.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/issues/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "modern-async",
          "vendor": "nicolas-van",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don\u0027t. Any code calling these functions will be written thinking they would limit the concurrency but they won\u0027t. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T18:25:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolas-van/modern-async/issues/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
        }
      ],
      "source": {
        "advisory": "GHSA-3pcq-34w5-p4g2",
        "discovery": "UNKNOWN"
      },
      "title": "Unlimited requests in modern-async",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41167",
          "STATE": "PUBLIC",
          "TITLE": "Unlimited requests in modern-async"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "modern-async",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.0.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "nicolas-van"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don\u0027t. Any code calling these functions will be written thinking they would limit the concurrency but they won\u0027t. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2",
              "refsource": "CONFIRM",
              "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
            },
            {
              "name": "https://github.com/nicolas-van/modern-async/issues/5",
              "refsource": "MISC",
              "url": "https://github.com/nicolas-van/modern-async/issues/5"
            },
            {
              "name": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436",
              "refsource": "MISC",
              "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3pcq-34w5-p4g2",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41167",
    "datePublished": "2021-10-20T18:25:12.000Z",
    "dateReserved": "2021-09-15T00:00:00.000Z",
    "dateUpdated": "2024-08-04T02:59:31.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-41167 (GCVE-0-2021-41167)

    Vulnerability from cvelistv5 – Published: 2021-10-20 18:25 – Updated: 2024-08-04 02:59
    VLAI
    Title
    Unlimited requests in modern-async
    Summary
    modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    References
    Impacted products
    Vendor Product Version
    nicolas-van modern-async Affected: < 1.0.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/issues/5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "modern-async",
          "vendor": "nicolas-van",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don\u0027t. Any code calling these functions will be written thinking they would limit the concurrency but they won\u0027t. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T18:25:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolas-van/modern-async/issues/5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
        }
      ],
      "source": {
        "advisory": "GHSA-3pcq-34w5-p4g2",
        "discovery": "UNKNOWN"
      },
      "title": "Unlimited requests in modern-async",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41167",
          "STATE": "PUBLIC",
          "TITLE": "Unlimited requests in modern-async"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "modern-async",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.0.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "nicolas-van"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don\u0027t. Any code calling these functions will be written thinking they would limit the concurrency but they won\u0027t. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2",
              "refsource": "CONFIRM",
              "url": "https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2"
            },
            {
              "name": "https://github.com/nicolas-van/modern-async/issues/5",
              "refsource": "MISC",
              "url": "https://github.com/nicolas-van/modern-async/issues/5"
            },
            {
              "name": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436",
              "refsource": "MISC",
              "url": "https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3pcq-34w5-p4g2",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41167",
    "datePublished": "2021-10-20T18:25:12.000Z",
    "dateReserved": "2021-09-15T00:00:00.000Z",
    "dateUpdated": "2024-08-04T02:59:31.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}