Archive
1 February 2019
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
High 8.8
Authentication Bypass by Spoofing in express-cart
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
-
High —
Path Traversal in simplehttpserver
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL.
-
High —
Prototype Pollution in lodash
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
-
High —
Path Traversal in http-live-simulator
Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.
-
High 7.5
mcstatic directory traversal vulnerability
A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
-
High 7.5
Prototype Pollution in mpath
A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
-
High 7.5
Pylons Colander Denial of Service vulnerability
In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.