Openjsf Express vulnerabilities

CVE-2024-10491 [MEDIUM] CWE-74 CVE-2024-10491: A vulnerability has been identified in the Express response.links function, allowing for arbitrary r A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerab

CVE-2024-43796 [MEDIUM] CWE-79 CVE-2024-43796: Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - ev Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVE-2024-29041 [MEDIUM] CWE-601 CVE-2024-29041: Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-rel Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/en

CVE-2022-24999 [HIGH] CWE-1321 CVE-2022-24999: qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a N qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application,

CVE-2014-6393 [MEDIUM] CWE-79 CVE-2014-6393: The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset fiel The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.