Archive
June 2018
Vulnerabilities first published in this month (UTC), newest first.
1,787 results · Feed
-
High 7.5
Directory Traversal in zjjserver
zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
gruntcli is malware
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
Nodesass is malware
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Critical 9.8
pandora-doomsday is malware
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
-
High 7.5
Directory Traversal in infraserver
infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in chatbyvista
chatbyvista is a file server. chatbyvista is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in qinserve
qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium 5.3
Directory Traversal in dasafio
dasafio is a web server. dasafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. File access is restricted to only .html files.
-
High —
Directory Traversal in node-server-forfront
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.3
discordi.js is malware
discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.
-
High 7.5
Directory Traversal in datachannel-client
datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in sspa
sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in gaoxiaotingtingting
gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in ewgaddis.lab6
ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in unicorn-list
unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in yyooopack
yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in wind-mvc
wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in xtalk
xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
Low 3.7
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
-
High —
Directory Traversal in liuyaserver
liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in serverwzl
serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in 22lixian
22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium —
Regular Expression Denial of Service in slug
slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
-
High 7.5
coffe-script is malware
The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
Directory Traversal in wintiwebdev
wintiwebdev is a static file server. wintiwebdev is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
node-openssl is malware
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High —
Directory Traversal in list-n-stream
list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in yzt
yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in lessindex
lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in censorify.tanisjr
censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in whispercast
whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium —
jquey is malware
The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
Regular Expression Denial of Service in forwarded
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a den…
-
High 7.5
Directory Traversal in sgqserve
sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
ffmepg is malware
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Regular Expression Denial of Service in marked
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
-
High 7.5
Directory Traversal in serverxxx
serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in enserver
enserver is a simple web server. enserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in serverzyy
serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in uv-tj-demo
uv-tj-demo is a static file server. uv-tj-demo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.