Archive
7 June 2018
Vulnerabilities first published on this day (UTC), newest first.
237 results · Feed
-
Unscored —
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and …
-
Unscored —
A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software c…
-
High 7.5
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, rem…
KEV Nov 3, 2021 -
Unscored —
A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to acce…
-
Unscored —
A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenti…
-
Unscored —
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco …
-
Medium 5.4
Stored Cross-Site Scripting in simplehttpserver
simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
-
High 7.5
Denial of Service vulnerability with large JSON payloads in fastify
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.
-
High 7.5
Path Traversal in localhost-now
localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in mcstatic
mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
-
High 7.5
Regular Expression Denial of Service in sshpk
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
-
Medium 6.5CVE-2018-3714 Scanner template
Path Traversal in node-srv
node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.
-
Medium 6.5
Path Traversal in angular-http-server
angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in 626
626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in resolve-path
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in hekto
hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in public
public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
-
Medium 6.5
Path Traversal in glance
glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.
-
Medium 6.1
bracket-template vulnerable to reflected XSS
bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
-
Medium 5.5
Denial of Service in protobufjs
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
-
High 8.8
Prototype Pollution in mixin-deep
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that …
-
High 7.5
Path Traversal in general-file-server
general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in crud-file-server
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
-
Critical 9.1
Denial of Service in https-proxy-agent
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
-
High 8.8
Prototype Pollution in defaults-deep
defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property th…
-
Medium 6.5
Directory Traversal in serve
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.
-
High 8.8
Prototype Pollution in assign-deep
assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that…
-
Medium 6.5
Prototype Pollution in lodash
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition…
-
Medium 5.3
vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
-
Medium 5.4
Cross-Site Scripting in connect
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.
-
High 8.8
Prototype Pollution in merge-deep
merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that …
-
High 7.5
Regular Expression Denial of Service in content
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Dispo…
-
High 7.5
Directory Traversal in fast-http-cli
fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
mssql.js is malware
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Directory Traversal in commentapp.stetsonwood
commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in wangguojing123
wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Critical 9.8
npm-script-demo is malware
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
-
High 7.5
method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially cr…
-
High 7.5
Directory Traversal in byucslabsix
byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in zwserver
zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.