Archive
29 May 2018
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
Critical —CVE-2015-9235 Public exploit
Verification Bypass in jsonwebtoken
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …
-
Critical 9.1
Out-of-bounds Read in atob
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
-
Critical 9.8
Path Traversal in html-pages
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
-
Critical 9.8
Authentication Bypass in hapi-auth-jwt2
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.