Skip to content
OpenAdvisories

Archive

23 January 2017

Vulnerabilities first published on this day (UTC), newest first.

← December 2016 2017 / January /23 February 2017 →
  1. 11
  2. 24
  3. 35
  4. 419
  5. 514
  6. 653
  7. 7 
  8. 8 
  9. 95
  10. 1016
  11. 1152
  12. 12159
  13. 1341
  14. 1410
  15. 1510
  16. 162
  17. 177
  18. 1861
  19. 1939
  20. 2025
  21. 211
  22. 22 
  23. 2397
  24. 2410
  25. 2510
  26. 2631
  27. 27261
  28. 2845
  29. 29 
  30. 3057
  31. 3148
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.1
    CVE-2015-8856

    Cross-Site Scripting in serve-index

    Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

    serve-index node-serve-index node-serve-index Debian Ubuntu npm
  • Medium 6.1
    CVE-2015-8861

    Cross-Site Scripting in handlebars

    The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

    handlebars mustache.js Debian npm
  • Medium 5.3
    CVE-2015-8859

    Root Path Disclosure in send

    The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

    nodejs-nodemon send node-send node-send Debian Ubuntu Azure Linux npm
  • Medium 6.1
    CVE-2015-8862

    Cross-Site Scripting in mustache

    mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

    mustache.js mustache Debian npm
  • Medium 6.1
    CVE-2013-7454

    Multiple XSS Filter Bypasses in validator

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.

    validator npm
  • Medium 6.1
    CVE-2013-7451

    Moderate severity vulnerability that affects validator

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.

    validator npm
  • Medium 6.1
    CVE-2013-7453

    Moderate severity vulnerability that affects validator

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.

    validator npm
  • Medium 6.1
    CVE-2013-7452

    Moderate severity vulnerability that affects validator

    The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.

    validator npm
  • Medium 6.1
    CVE-2014-9772

    XSS Filter Bypass via Encoded URL in validator

    The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.

    validator npm
  • Medium 6.1
    CVE-2016-4056

    TYPO3 Backend component Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.

    typo3/cms Packagist
  • Medium 6.5
    CVE-2016-4055

    Regular Expression Denial of Service in moment

    The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

    moment node-moment node-moment Debian Ubuntu npm
  • Medium 6.2
    CVE-2016-9401

    popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.

    bash bash bash Debian Ubuntu Alpine