Archive
7 June 2018
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
Critical 9.1
Denial of Service in https-proxy-agent
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
-
Critical 9.8
npm-script-demo is malware
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
-
Critical 9.8
Chromium Remote Code Execution in electron
Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless …
-
Critical 10.0CVE-2017-16088 Public exploit
Sandbox Breakout in safe-eval
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
-
Critical 9.8
Remote Code Execution in pg
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…
-
Critical 9.8
pandora-doomsday is malware
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
-
Critical —
Command Injection in dns-sync
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.