Show plain JSON{"id": "CVE-2014-10064", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-05-31T20:29:00.220", "references": [{"url": "https://nodesecurity.io/advisories/28", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}, {"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring."}, {"lang": "es", "value": "El m\u00f3dulo qs en versiones anteriores a la 1.0.0 no tiene una opci\u00f3n o configuraci\u00f3n por defecto para especificar la profundidad del objeto y, al analizar una cadena que representa un objeto profundamente anidado, bloquear\u00e1 el bucle de eventos durante largos per\u00edodos de tiempo. Un atacante podr\u00eda aprovecharse de esto para provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS), por ejemplo, en una aplicaci\u00f3n web; otras peticiones no se procesar\u00edan mientras ocurre este bloqueo."}], "lastModified": "2019-10-09T23:09:44.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9380A9BB-F9DF-43D5-AA81-DBFA67DE2CC9", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"} 