Cris Staicu

**Name of the Vulnerable Software and Affected Versions** bigint-buffer versions 0.0.0 through 1.1.5 **Description** The package bigint-buffer is susceptible to a buffer overflow issue within the `toBigIntLE()` function. An attacker can exploit this flaw to cause the application to crash. **Recommendations** bigint-buffer versions 0.0.0 through 1.1.5 are affected and should be updated to a newer, secure version when available.

**Name of the Vulnerable Software and Affected Versions** node-bluetooth-serial-port versions all **Description** The issue is related to a Buffer Overflow vulnerability via the `findSerialPortChannel` method due to improper user input length validation. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For all versions, consider disabling the `findSerialPortChannel` method until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** node-bluetooth versions all **Description** The issue arises from improper user input length validation, leading to a Buffer Overflow via the `findSerialPortChannel` method. **Recommendations** For all versions, as a temporary workaround, consider disabling the `findSerialPortChannel` method until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vm2 versions prior to 3.9.6 **Description** The issue allows for Sandbox Bypass via direct access to host error objects generated by node internals during generation of stacktraces. This can lead to execution of arbitrary code on the host machine. **Recommendations** For versions prior to 3.9.6, update to version 3.9.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `vm2` package until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** vm2 versions prior to 3.9.4 **Description** The issue is related to a Prototype Pollution attack vector, which can lead to sandbox escape and execution of arbitrary code on the host machine. This allows for the execution of arbitrary code on the host machine, posing a significant security risk. **Recommendations** For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vm2 package until a patch is applied.