Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
3,116 results · Clear filters · Feed
-
High 8.8
jquery-plugin-query-object contains prototype pollution vulnerability
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
-
High 8.8
Prototype Pollution in backbone-query-parameters
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
-
High 8.8CVE-2021-20086 Scanner template
Prototype Pollution in jquery-bbq
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
-
High 8.8
Prototype Pollution in jquery-deparam
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype.
-
High 8.8
mootools-more vulnerable to prototype pollution
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.
-
High 7.3
Arbitrary Command Injection
This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
-
High 7.3
Arbitrary Command Injection
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
-
High 7.3
Arbitrary Command Injection
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
-
High 7.3
Arbitrary Command Injection
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
-
High 8.1
Any logged in user could edit any other logged in user.
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked …
-
High 7.7
Broken Authentication in Atlassian Connect Express
Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express a…
-
High 7.8
Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability
Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability
-
High 7.5
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.
-
High 8.1
ApiKey secret could be revelated on network issue
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
-
High 8.0CVE-2021-21413 Public exploit
Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate
isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isol…
-
High 7.3
Prototype Pollution
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
-
High 7.5
Arbitrary Command Injection
This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will…
-
High 7.5
Regular Expression Denial-of-Service in npm schema-inspector
Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.…
-
High 7.5
Arbitrary Command Injection
This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC wi…
-
High 7.5
Regular Expression Denial of Service (ReDoS) in ua-parser-js
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
-
High —
Vulnerability allowing for reading internal HTTP resources
### Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read …
-
High 7.5
Regular Expression Denial of Service (ReDoS)
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
-
High 8.6
Command Injection
This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
-
High 8.8CVE-2021-26814 Public exploit
Improper Input Validation (RCE)
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject…
-
High 8.1CVE-2020-28502 Public exploit
Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and …
-
High 7.7
Prototype Pollution in Node-Red
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object wit…
-
High 7.8CVE-2021-26700 Public exploit
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
-
High 7.5
Denial of Service (DoS) in restify-paginate
The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.
-
High 7.3
Command Injection
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
-
High 7.5
URIjs Hostname spoofing via backslashes in URL
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
-
High 8.8
Integer Overflow in png-img
An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
-
High 8.6
Cross-site Scripting (XSS)
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, b…
-
High 7.3
Prototype Pollution
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color…
-
High 7.1
Command Injection Vulnerability
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerabili…
KEV Jan 18, 2022 -
High 7.2
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
-
High 7.5
Denial of Service in get-ip-range
The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.