vuln: add recent vulnerabilities

vuln/core/118.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32002"],
+  "vulnerable": "16.x || 18.x || 20.x",
+  "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/119.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32004"],
+  "vulnerable": "20.x",
+  "patched": "^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/120.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32558"],
+  "vulnerable": "20.x",
+  "patched": "^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "The use of the deprecated API process.binding() can bypass the permission model through path traversal.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/121.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32006"],
+  "vulnerable": "16.x || 18.x || 20.x",
+  "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/122.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32559"],
+  "vulnerable": "16.x || 18.x || 20.x",
+  "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/123.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32005"],
+  "vulnerable": "20.x",
+  "patched": "^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/124.json

@@ -0,0 +1,8 @@
+{
+  "cve": ["CVE-2023-32003"],
+  "vulnerable": "20.x",
+  "patched": "^20.5.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+  "overview": "fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack.",
+  "affectedEnvironments": ["all"]
+}

vuln/core/index.json

@@ -1462,5 +1462,89 @@
     "affectedEnvironments": [
       "all"
     ]
+  },
+  "118": {
+    "cve": [
+      "CVE-2023-32002"
+    ],
+    "vulnerable": "16.x || 18.x || 20.x",
+    "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "119": {
+    "cve": [
+      "CVE-2023-32004"
+    ],
+    "vulnerable": "20.x",
+    "patched": "^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "120": {
+    "cve": [
+      "CVE-2023-32558"
+    ],
+    "vulnerable": "20.x",
+    "patched": "^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "The use of the deprecated API process.binding() can bypass the permission model through path traversal.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "121": {
+    "cve": [
+      "CVE-2023-32006"
+    ],
+    "vulnerable": "16.x || 18.x || 20.x",
+    "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "122": {
+    "cve": [
+      "CVE-2023-32559"
+    ],
+    "vulnerable": "16.x || 18.x || 20.x",
+    "patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "123": {
+    "cve": [
+      "CVE-2023-32005"
+    ],
+    "vulnerable": "20.x",
+    "patched": "^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.",
+    "affectedEnvironments": [
+      "all"
+    ]
+  },
+  "124": {
+    "cve": [
+      "CVE-2023-32003"
+    ],
+    "vulnerable": "20.x",
+    "patched": "^20.5.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
+    "overview": "fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack.",
+    "affectedEnvironments": [
+      "all"
+    ]
   }
 }