Skip to content
OpenAdvisories

Archive

31 May 2018

Vulnerabilities first published on this day (UTC), newest first.

← April 2018 2018 / May /31 June 2018 →
  1. 131
  2. 263
  3. 313
  4. 435
  5. 55
  6. 64
  7. 719
  8. 829
  9. 9105
  10. 1049
  11. 1125
  12. 127
  13. 134
  14. 1450
  15. 1537
  16. 1628
  17. 17139
  18. 1831
  19. 1938
  20. 204
  21. 2113
  22. 2263
  23. 2332
  24. 2455
  25. 2546
  26. 2617
  27. 27 
  28. 2811
  29. 2980
  30. 3030
  31. 31101
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical —
    CVE-2016-10548

    Arbitrary Code Injection in reduce-css-calc

    Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.

    HackerOne reduce-css-calc node module reduce-css-calc npm
  • Critical 9.8
    CVE-2016-10541

    Potential Command Injection in shell-quote

    The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

    HackerOne shell-quote node module shell-quote npm
  • Critical —
    CVE-2016-10546

    Arbitrary Code Injection in pouchdb

    An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary Ja…

    HackerOne pouchdb node module pouchdb npm
  • Critical —
    CVE-2016-10555 Public exploit

    Forgeable Public/Private Tokens in jwt-simple

    Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…

    HackerOne jwt-simple node module jwt-simple npm
  • Critical 9.8
    CVE-2016-10532

    Authentication Bypass in console-io

    console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This …

    HackerOne console-io node module console-io npm
  • Critical 9.8
    CVE-2018-11138 Exploited · Ransomware Public exploit Scanner template EPSS 92%

    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible b…

    KEV Mar 25, 2022