Cleartext Transmission of Sensitive Information in moment-timezone

Description

No description available.

Recommendation

Update the moment-timezone package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.1.0, < 0.5.35
• Patched version(s): 0.5.35

References

• GHSA-v78c-4p63-2j6c
• CWE-319
• OWASP 2021-A2

Related Issues

• Command Injection in moment-timezone - Vulnerability
• react-native-mmkv Insertion of Sensitive Information into Log File vulnerability - CVE-2024-21668
• angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend - CVE-2023-28444
• Exposure of Sensitive Information in eventsource - CVE-2022-1650

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

moment-timezone