Archive
May 2018
Vulnerabilities first published in this month (UTC), newest first.
1,164 results · Feed
-
High —
Downloads Resources over HTTP in embedza
embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote co…
-
Critical —
Arbitrary Code Injection in pouchdb
An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary Ja…
-
High —
Potential SQL Injection in sequelize
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
-
Critical —CVE-2016-10555 Public exploit
Forgeable Public/Private Tokens in jwt-simple
Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…
-
High 7.5
Regular Expression Denial of Service in minimatch
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
-
Critical 9.8
Authentication Bypass in console-io
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This …
-
High —
Downloads Resources over HTTP in go-ipfs-dep
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
-
High —
Downloads Resources over HTTP in galenframework-cli
galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the request…
-
Medium —
Directory Traversal in bitty
Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.
-
High —
Downloads Resources over HTTP in mongodb-instance
mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an att…
-
High —
Private Data Disclosure in express-restify-mongoose
express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the…
-
Medium 6.1
Sanitization bypass using HTML Entities in marked
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascri…
-
Low —
SSL Validation Defaults to False in electron-packager
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explic…
-
Medium —
Insecure Default Configuration in airbrake
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all …
-
High —
Downloads Resources over HTTP in iedriver
iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested bina…
-
Medium 5.4
Cross-Site Scripting in backbone
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of b…
-
Medium —
Cross-Site Scripting in nunjucks
Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, s…
-
High —
Timing Attack in csrf-lite
csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)…
-
Medium 6.1
Sinatra Cross-site Scripting vulnerability
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
-
Unscored —
The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance …
-
Unscored —
In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies …
-
Unscored —
The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Ap…
-
Critical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible b…
KEV Mar 25, 2022 -
Unscored —
The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance …
-
Unscored —CVE-2018-11133 Scanner template
The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.…
-
Unscored —
The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated user…
-
Unscored —
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE Syst…
-
Unscored —
SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys fun…
-
Unscored —CVE-2018-11132 EPSS 18%
In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies o…
-
Unscored —CVE-2018-11139 EPSS 42%
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible…
-
Unscored —
The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management…
-
Unscored —
Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file v…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file v…
-
Unscored —
Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file v…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file v…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclo…
-
Unscored —
In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Pr…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Disc…
-
Unscored —
Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file v…