Hackerone - vulnerabilities (CVEs)
470 CVEs in 448 products, 0 in the last 30 days, newest from 2019-02-12.
Products
- Hapi Node Module - 4 CVEs
- Rubygems - 4 CVEs
- Sequelize Node Module - 4 CVEs
- Coffeescript Node Module - 3 CVEs
- Crud-file-server Node Module - 2 CVEs
- Express-cart - 2 CVEs
- Html-janitor Node Module - 2 CVEs
- I18next Node Module - 2 CVEs
- M-server - 2 CVEs
- Marked Node Module - 2 CVEs
- Nextcloud Server - 2 CVEs
- Private Address Check Ruby Gem - 2 CVEs
- Remarkable Node Module - 2 CVEs
- Sanitize-html Node Module - 2 CVEs
- Serve Node Module - 2 CVEs
- Ws Node Module - 2 CVEs
- 11xiaoli Node Module - 1 CVEs
- 22lixian Node Module - 1 CVEs
- 360class.jansenhm Node Module - 1 CVEs
- 626 Node Module - 1 CVEs
- Active-support Ruby Gem - 1 CVEs
- Adamvr-geoip-lite Node Module - 1 CVEs
- Aedes - 1 CVEs
- Aegir Node Module - 1 CVEs
- Aerospike Node Module - 1 CVEs
- Ag-grid Node Module - 1 CVEs
- Air-sdk Node Module - 1 CVEs
- Airbrake Node Module - 1 CVEs
- Airmax - 1 CVEs
- Alto-saxophone Node Module - 1 CVEs
- Angular-http-server Node Module - 1 CVEs
- Ansi2html Node Module - 1 CVEs
- Apk-parser2 Node Module - 1 CVEs
- Apk-parser3 Node Module - 1 CVEs
- Apk-parser Node Module - 1 CVEs
- Appium-chromedriver Node Module - 1 CVEs
- Arcanist Node Module - 1 CVEs
- Arrayfire-js Node Module - 1 CVEs
- Assign-deep Node Module - 1 CVEs
- Atob Node Module - 1 CVEs
- Atom-node-module-installer Node Module - 1 CVEs
- Augustine Node Module - 1 CVEs
- Babelcli Node Module - 1 CVEs
- Backbone Node Module - 1 CVEs
- Badjs-sourcemap-server Node Module - 1 CVEs
- Baryton-saxophone Node Module - 1 CVEs
- Bionode-sra Node Module - 1 CVEs
- Bittorrent-dht Node Module - 1 CVEs
- Bitty Node Module - 1 CVEs
- Bkjs-wand Node Module - 1 CVEs
- Box2d-native Node Module - 1 CVEs
- Bracket-template Node Module - 1 CVEs
- Broccoli-closure Node Module - 1 CVEs
- Byucslabsix Node Module - 1 CVEs
- Call Node Module - 1 CVEs
- Calmquist.static-server Node Module - 1 CVEs
- Caolilinode Node Module - 1 CVEs
- Censorify.tanisjr Node Module - 1 CVEs
- Charset Node Module - 1 CVEs
- Chatbyvista Node Module - 1 CVEs
- Chromedriver126 Node Module - 1 CVEs
- Chromedriver Node Module - 1 CVEs
- Citypredict.whauwiller Node Module - 1 CVEs
- Clang-extra Node Module - 1 CVEs
- Cli Node Module - 1 CVEs
- Closurecompiler Node Module - 1 CVEs
- Cloudpub-redis Node Module - 1 CVEs
- Cmake Node Module - 1 CVEs
- Co-cli-installer Node Module - 1 CVEs
- Cobalt-cli Node Module - 1 CVEs
- Commentapp.stetsonwood Node Module - 1 CVEs
- Connect Node Module - 1 CVEs
- Console-io Node Module - 1 CVEs
- Content Node Module - 1 CVEs
- Cross-env.js Node Module - 1 CVEs
- Crossenv Node Module - 1 CVEs
- Csrf-lite Node Module - 1 CVEs
- Cuciuci Node Module - 1 CVEs
- Cue-sdk-node Node Module - 1 CVEs
- Curses Node Module - 1 CVEs
- Cyber-js Node Module - 1 CVEs
- Cypserver Node Module - 1 CVEs
- D3.js Node Module - 1 CVEs
- Dalek-browser-chrome-canary Node Module - 1 CVEs
- Dalek-browser-chrome Node Module - 1 CVEs
- Dalek-browser-ie-canary Node Module - 1 CVEs
- Dalek-browser-ie Node Module - 1 CVEs
- Dasafio Node Module - 1 CVEs
- Datachannel-client Node Module - 1 CVEs
- Dcdcdcdcdc Node Module - 1 CVEs
- Dcserver Node Module - 1 CVEs
- Debug Node Module - 1 CVEs
- Decamelize Node Module - 1 CVEs
- Defaults-deep - 1 CVEs
- Defaults-deep Node Module - 1 CVEs
- Desafio Node Module - 1 CVEs
- Dgard8.lab6 Node Module - 1 CVEs
- Discordi.js Node Module - 1 CVEs
- Dmmcquay.lab6 Node Module - 1 CVEs
- Dns-sync Node Module - 1 CVEs
- Droppy Node Module - 1 CVEs
- Dwebp-bin Node Module - 1 CVEs
- Dylmomo Node Module - 1 CVEs
- Earlybird Node Module - 1 CVEs
- Easyquick Node Module - 1 CVEs
- Ecstatic Node Module - 1 CVEs
- Edgemax - 1 CVEs
- Elding Node Module - 1 CVEs
- Electron-packager Node Module - 1 CVEs
- Electron Node Module - 1 CVEs
- Embedza Node Module - 1 CVEs
- Engine.io-client Node Module - 1 CVEs
- Enserver Node Module - 1 CVEs
- Ewgaddis.lab6 Node Module - 1 CVEs
- Express-restify-mongoose Node Module - 1 CVEs
- Extend - 1 CVEs
- Exxxxxxxxxxx Node Module - 1 CVEs
- F2e-server Node Module - 1 CVEs
- Fabric-js Node Module - 1 CVEs
- Fancy-server Node Module - 1 CVEs
- Fast-http-cli Node Module - 1 CVEs
- Fastify Node Module - 1 CVEs
- Fbr-client Node Module - 1 CVEs
- Ffmepg Node Module - 1 CVEs
- Fibjs Node Module - 1 CVEs
- Fis-parser-sass-bin Node Module - 1 CVEs
- Fis-sass-all Node Module - 1 CVEs
- Forms Node Module - 1 CVEs
- Forwarded Node Module - 1 CVEs
- Frames-compiler Node Module - 1 CVEs
- Fresh Node Module - 1 CVEs
- Fsk-server Node Module - 1 CVEs
- Fuseki Node Module - 1 CVEs
- Galenframework-cli Node Module - 1 CVEs
- Gaoxiaotingtingting Node Module - 1 CVEs
- Gaoxuyan Node Module - 1 CVEs
- General-file-server Node Module - 1 CVEs
- Geoip-lite-country Node Module - 1 CVEs
- Getcityapi.yoehoehne Node Module - 1 CVEs
- Gfe-sass Node Module - 1 CVEs
- Gitbook Node Module - 1 CVEs
- Glance Node Module - 1 CVEs
- Go-ipfs-dep Node Module - 1 CVEs
- Gomeplus-h5-proxy Node Module - 1 CVEs
- Google-closure-tools-latest Node Module - 1 CVEs
- Goserv Node Module - 1 CVEs
- Growl Node Module - 1 CVEs
- Grunt-ccompiler Node Module - 1 CVEs
- Grunt-gh-pages Node Module - 1 CVEs
- Grunt-images Node Module - 1 CVEs
- Grunt-webdriver-qunit Node Module - 1 CVEs
- Gruntcli Node Module - 1 CVEs
- Hapi-auth-jwt2 Node Module - 1 CVEs
- Haxe-dev Node Module - 1 CVEs
- Haxe3 Node Module - 1 CVEs
- Haxe Node Module - 1 CVEs
- Hcbserver Node Module - 1 CVEs
- Headless-browser-lite Node Module - 1 CVEs
- Healthcenter Node Module - 1 CVEs
- Hekto - 1 CVEs
- Hekto Node Module - 1 CVEs
- Herbivore Node Module - 1 CVEs
- Hftp Node Module - 1 CVEs
- Hostr Node Module - 1 CVEs
- Html-pages - 1 CVEs
- Html-pages Node Module - 1 CVEs
- Http-live-simulator - 1 CVEs
- Http-proxy.js Node Module - 1 CVEs
- Http-proxy Node Module - 1 CVEs
- Http-signature Node Module - 1 CVEs
- Http Static Simple Node Module - 1 CVEs
- Https-proxy-agent Node Module - 1 CVEs
- Httpsync Node Module - 1 CVEs
- Hubl-server Node Module - 1 CVEs
- I18n-node-angular Node Module - 1 CVEs
- Ibapi Node Module - 1 CVEs
- Ibm Db Node Module - 1 CVEs
- Iedriver Node Module - 1 CVEs
- Igniteui Node Module - 1 CVEs
- Ikst Node Module - 1 CVEs
- Imageoptim Node Module - 1 CVEs
- Inert Node Module - 1 CVEs
- Infraserver Node Module - 1 CVEs
- Install-g-test Node Module - 1 CVEs
- Install-nw Node Module - 1 CVEs
- Intsol-package Node Module - 1 CVEs
- Ipip-coffee Node Module - 1 CVEs
- Ipip Node Module - 1 CVEs
- Iter-http Node Module - 1 CVEs
- Jadedown Node Module - 1 CVEs
- Jansenstuffpleasework Node Module - 1 CVEs
- Jdf-sass Node Module - 1 CVEs
- Jikes Node Module - 1 CVEs
- Jn Jj Server Node Module - 1 CVEs
- Jquery.js Node Module - 1 CVEs
- Jquey Node Module - 1 CVEs
- Js-given Node Module - 1 CVEs
- Jser-stat Node Module - 1 CVEs
- Jshamcrest Node Module - 1 CVEs
- Jsonwebtoken Node Module - 1 CVEs
- Jstestdriver Node Module - 1 CVEs
- Just-extend - 1 CVEs
- Jvminstall Node Module - 1 CVEs
- Jwt-simple Node Module - 1 CVEs
- Keystone Node Module - 1 CVEs
- Kindlegen Node Module - 1 CVEs
- Lab6.brit95 Node Module - 1 CVEs
- Lab6drewfusbyu Node Module - 1 CVEs
- Lessindex Node Module - 1 CVEs
- Libsbml Node Module - 1 CVEs
- Libsbmlsim Node Module - 1 CVEs
- Libxl Node Module - 1 CVEs
- Limbus-buildgen Node Module - 1 CVEs
- List-n-stream Node Module - 1 CVEs
- Liuyaserver Node Module - 1 CVEs
- Liyujing Node Module - 1 CVEs
- Localhost-now Node Module - 1 CVEs
- Lodash - 1 CVEs
- Lodash Node Module - 1 CVEs
- Looppake Node Module - 1 CVEs
- Ltt Node Module - 1 CVEs
- Macaca-chromedriver-zxa Node Module - 1 CVEs
- Macaca-chromedriver Node Module - 1 CVEs
- Mariadb Node Module - 1 CVEs
- Marionette-socket-host Node Module - 1 CVEs
- Markdown-pdf - 1 CVEs
- Massif Node Module - 1 CVEs
- Mcstatic - 1 CVEs
- Mcstatic Node Module - 1 CVEs
- Merge - 1 CVEs
- Merge-deep Node Module - 1 CVEs
- Method-override Node Module - 1 CVEs
- Mfrs Node Module - 1 CVEs
- Mfrserver Node Module - 1 CVEs
- Mime Node Module - 1 CVEs
- Minimatch Node Module - 1 CVEs
- Mixin-deep Node Module - 1 CVEs
- Mockserve Node Module - 1 CVEs
- Mongodb-instance Node Module - 1 CVEs
- Mongose Node Module - 1 CVEs
- Morris.js Node Module - 1 CVEs
- Mpath - 1 CVEs
- Mqtt-packet Node Module - 1 CVEs
- Mssql-node Node Module - 1 CVEs
- Mssql.js Node Module - 1 CVEs
- Myprolyz Node Module - 1 CVEs
- Myserver.alexcthomas18 Node Module - 1 CVEs
- Mysql Node Module - 1 CVEs
- Mysqljs Node Module - 1 CVEs
- Mystem-fix Node Module - 1 CVEs
- Mystem-wrapper Node Module - 1 CVEs
- Mystem3 Node Module - 1 CVEs
- Mystem Node Module - 1 CVEs
- Native-opencv Node Module - 1 CVEs
- Negotiator Node Module - 1 CVEs
- Nes Node Module - 1 CVEs
- No-case Node Module - 1 CVEs
- Node-air-sdk Node Module - 1 CVEs
- Node-browser Node Module - 1 CVEs
- Node-bsdiff-android Node Module - 1 CVEs
- Node-fabric Node Module - 1 CVEs
- Node-jose Node Module - 1 CVEs
- Node-opencv Node Module - 1 CVEs
- Node-opensl Node Module - 1 CVEs
- Node-openssl Node Module - 1 CVEs
- Node-server-forfront Node Module - 1 CVEs
- Node-simple-router Node Module - 1 CVEs
- Node-sqlite Node Module - 1 CVEs
- Node-srv Node Module - 1 CVEs
- Node-thulac Node Module - 1 CVEs
- Node-tkinter Node Module - 1 CVEs
- Node.extend - 1 CVEs
- Nodeaaaaa Node Module - 1 CVEs
- Nodecaffe Node Module - 1 CVEs
- Nodefabric Node Module - 1 CVEs
- Nodeffmpeg Node Module - 1 CVEs
- Nodemailer-js Node Module - 1 CVEs
- Nodemailer.js Node Module - 1 CVEs
- Nodemssql Node Module - 1 CVEs
- Noderequest Node Module - 1 CVEs
- Nodesass Node Module - 1 CVEs
- Nodeschnaps Node Module - 1 CVEs
- Nodesqlite Node Module - 1 CVEs
- Nodewebkit Node Module - 1 CVEs
- Npm-script-demo Node Module - 1 CVEs
- Npm-test-sqlite3-trunk Node Module - 1 CVEs
- Ntfserver Node Module - 1 CVEs
- Nunjucks Node Module - 1 CVEs
- Nw-with-arm Node Module - 1 CVEs
- Nw Node Module - 1 CVEs
- Open-device Node Module - 1 CVEs
- Opencv.js Node Module - 1 CVEs
- Openframe-ascii-image Node Module - 1 CVEs
- Openframe-glslviewer Node Module - 1 CVEs
- Openframe-image Node Module - 1 CVEs
- Openssl.js Node Module - 1 CVEs
- Operadriver Node Module - 1 CVEs
- Pandora-doomsday Node Module - 1 CVEs
- Parsejson Node Module - 1 CVEs
- Paypal-ipn Node Module - 1 CVEs
- Pdfinfojs - 1 CVEs
- Peiserver Node Module - 1 CVEs
- Pennyworth Node Module - 1 CVEs
- Pg Node Module - 1 CVEs
- Phantomjs-cheniu Node Module - 1 CVEs
- Picard Node Module - 1 CVEs
- Pk-app-wonderbox Node Module - 1 CVEs
- Pm2-kafka Node Module - 1 CVEs
- Pngcrush-installer Node Module - 1 CVEs
- Poco Node Module - 1 CVEs
- Pooledwebsocket Node Module - 1 CVEs
- Pouchdb Node Module - 1 CVEs
- Prebuild-lwip Node Module - 1 CVEs
- Prince Node Module - 1 CVEs
- Product-monitor Node Module - 1 CVEs
- Protobufjs Node Module - 1 CVEs
- Proxy.js Node Module - 1 CVEs
- Public - 1 CVEs
- Public Node Module - 1 CVEs
- Pytservce Node Module - 1 CVEs
- Qbs Node Module - 1 CVEs
- Qinserve Node Module - 1 CVEs
- Qs Node Module - 1 CVEs
- Quickserver Node Module - 1 CVEs
- React-native-baidu-voice-synthesizer Node Module - 1 CVEs
- React-native-meteor-oauth Node Module - 1 CVEs
- Redis-srvr Node Module - 1 CVEs
- Reduce-css-calc Node Module - 1 CVEs
- Reecerver Node Module - 1 CVEs
- Request Node Module - 1 CVEs
- Resolve-path Node Module - 1 CVEs
- Resourcehacker Node Module - 1 CVEs
- Restafary Node Module - 1 CVEs
- Restify Node Module - 1 CVEs
- Riot-compiler Node Module - 1 CVEs
- Robot-js Node Module - 1 CVEs
- Roslib-socketio Node Module - 1 CVEs
- Rs-brightcove Node Module - 1 CVEs
- Rtcmulticonnection-client Node Module - 1 CVEs
- Ruby - 1 CVEs
- Safe-eval Node Module - 1 CVEs
- Sails Node Module - 1 CVEs
- Sauce-connect Node Module - 1 CVEs
- Scala-bin Node Module - 1 CVEs
- Scalajs-standalone-bin Node Module - 1 CVEs
- Scott-blanch-weather-app Node Module - 1 CVEs
- Section2.madisonjbrooks12 Node Module - 1 CVEs
- Secure-compare Node Module - 1 CVEs
- Selenium-binaries Node Module - 1 CVEs
- Selenium-chromedriver Node Module - 1 CVEs
- Selenium-download Node Module - 1 CVEs
- Selenium-portal Node Module - 1 CVEs
- Selenium-standalone-painful Node Module - 1 CVEs
- Selenium-wrapper Node Module - 1 CVEs
- Sencisho Node Module - 1 CVEs
- Serc.js Node Module - 1 CVEs
- Serve46 Node Module - 1 CVEs
- Serverabc Node Module - 1 CVEs
- Serverhuwenhui Node Module - 1 CVEs
- Serverliujiayi1 Node Module - 1 CVEs
- Serverlyr Node Module - 1 CVEs
- Serverwg Node Module - 1 CVEs
- Serverwzl Node Module - 1 CVEs
- Serverxxx Node Module - 1 CVEs
- Serveryaozeyan Node Module - 1 CVEs
- Serveryztyzt Node Module - 1 CVEs
- Serverzyy Node Module - 1 CVEs
- Sexstatic - 1 CVEs
- Sfml Node Module - 1 CVEs
- Sgqserve Node Module - 1 CVEs
- Shadowsock Node Module - 1 CVEs
- Shell-quote Node Module - 1 CVEs
- Shenliru Node Module - 1 CVEs
- Shit-server Node Module - 1 CVEs
- Shout Node Module - 1 CVEs
- Simple-npm-registry Node Module - 1 CVEs
- Simplehttpserver - 1 CVEs
- Simplehttpserver Node Module - 1 CVEs
- Slimerjs-edge Node Module - 1 CVEs
- Slug Node Module - 1 CVEs
- Sly07 Node Module - 1 CVEs
- Smb Node Module - 1 CVEs
- Soci Node Module - 1 CVEs
- Socket.io Node Module - 1 CVEs
- Sprockets - 1 CVEs
- Sqlite.js Node Module - 1 CVEs
- Sqliter Node Module - 1 CVEs
- Sqlserver Node Module - 1 CVEs
- Sshpk Node Module - 1 CVEs
- Sspa Node Module - 1 CVEs
- St Node Module - 1 CVEs
- Static-eval Node Module Node Module - 1 CVEs
- Static-html-server Node Module - 1 CVEs
- Static-resource-server - 1 CVEs
- Statics-server - 1 CVEs
- Stattic Node Module - 1 CVEs
- Steroids Node Module - 1 CVEs
- Strider-sauce Node Module - 1 CVEs
- String Node Module - 1 CVEs
- Summit Node Module - 1 CVEs
- Superagent Node Module - 1 CVEs
- Susu-sum Node Module - 1 CVEs
- Sync-exec Node Module - 1 CVEs
- Tencent-server Node Module - 1 CVEs
- Timespan Node Module - 1 CVEs
- Tiny-http Node Module - 1 CVEs
- Tinyserver2 Node Module - 1 CVEs
- Tkinter Node Module - 1 CVEs
- Tmock Node Module - 1 CVEs
- Tomita-parser Node Module - 1 CVEs
- Tomita Node Module - 1 CVEs
- Ua-parser Node Module - 1 CVEs
- Uekw1511server Node Module - 1 CVEs
- Unicode-json Node Module - 1 CVEs
- Unicode Node Module - 1 CVEs
- Unicorn-list Node Module - 1 CVEs
- Uri-js Node Module - 1 CVEs
- Url-parse - 1 CVEs
- Useragent Node Module - 1 CVEs
- Utahcityfinder Node Module - 1 CVEs
- Uv-tj-demo Node Module - 1 CVEs
- Uws Node Module - 1 CVEs
- Wangguojing123 Node Module - 1 CVEs
- Wasdk Node Module - 1 CVEs
- Waterline-sequel Node Module - 1 CVEs
- Weather.swlyons Node Module - 1 CVEs
- Webdriver-launcher Node Module - 1 CVEs
- Webdrvr Node Module - 1 CVEs
- Webrtc-native Node Module - 1 CVEs
- Welcomyzt Node Module - 1 CVEs
- Wffserve Node Module - 1 CVEs
- Whispercast Node Module - 1 CVEs
- Wind-mvc Node Module - 1 CVEs
- Windows-build-tools Node Module - 1 CVEs
- Windows-iedriver Node Module - 1 CVEs
- Windows-latestchromedriver Node Module - 1 CVEs
- Windows-selenium-chromedriver Node Module - 1 CVEs
- Windows-seleniumjar-mirror Node Module - 1 CVEs
- Windows-seleniumjar Node Module - 1 CVEs
- Wintiwebdev Node Module - 1 CVEs
- Wixtoolset Node Module - 1 CVEs
- Xd-testing Node Module - 1 CVEs
- Xtalk Node Module - 1 CVEs
- Yttivy Node Module - 1 CVEs
- Yyooopack Node Module - 1 CVEs
- Yzt Node Module - 1 CVEs
- Zjjserver Node Module - 1 CVEs
- Zwserver Node Module - 1 CVEs
Newest CVEs of Hackerone
- CVE-2017-0938 - CVSS 7.5 (high), 2019-02-12: Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
- CVE-2018-16493 - CVSS 7.5 (high), 2019-02-01: A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending…
- CVE-2018-16491 - CVSS 9.8 (critical), 2019-02-01: A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
- CVE-2018-16490 - CVSS 7.5 (high), 2019-02-01: A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
- CVE-2018-16492 - CVSS 9.8 (critical), 2019-02-01: A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
- CVE-2018-16485 - CVSS 6.5 (medium), 2019-02-01: Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd…
- CVE-2018-16479 - CVSS 7.5 (high), 2019-02-01: Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.
- CVE-2018-16486 - CVSS 9.8 (critical), 2019-02-01: A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.
- CVE-2018-16482 - CVSS 7.5 (high), 2019-02-01: A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file…
- CVE-2018-16484 - CVSS 5.4 (medium), 2019-02-01: A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special…
- CVE-2018-16487 - CVSS 5.6 (medium), 2019-02-01: A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or…
- CVE-2018-16489 - CVSS 9.8 (critical), 2019-02-01: A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.
- CVE-2018-16483 - CVSS 8.8 (high), 2019-02-01: A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
- CVE-2018-16480 - CVSS 6.1 (medium), 2019-02-01: A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the…
- CVE-2018-16481 - CVSS 6.1 (medium), 2019-02-01: A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of…
- CVE-2018-16469 - CVSS 7.5 (high), 2018-10-30: The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be…
- CVE-2018-3787 - CVSS 7.5 (high), 2018-08-31: Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
- CVE-2018-3774 - CVSS 10 (critical), 2018-08-12: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication…
- CVE-2018-3775 - CVSS 8.8 (high), 2018-08-12: Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor…
- CVE-2018-3776 - CVSS 5.3 (medium), 2018-08-12: Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.
- CVE-2018-3779 - CVSS 9.8 (critical), 2018-08-10: active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker…
- CVE-2018-3778 - CVSS 5.3 (medium), 2018-08-08: Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
- CVE-2018-3771 - CVSS 6.1 (medium), 2018-07-20: An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
- CVE-2018-3770 - CVSS 5.5 (medium), 2018-07-20: A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
- CVE-2018-3760 - CVSS 7.5 (high), 2018-06-26: There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted…
- CVE-2018-3759 - CVSS 3.7 (low), 2018-06-13: private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being…
- CVE-2018-3758 - CVSS 8.8 (high), 2018-06-07: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
- CVE-2018-3732 - CVSS 7.5 (high), 2018-06-07: resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which…
- CVE-2018-3737 - CVSS 7.5 (high), 2018-06-07: sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
- CVE-2018-3718 - CVSS 5.3 (medium), 2018-06-07: serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
