Ecosystem

npm

7,703 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

98 results · Clear filters · Feed

Medium 5.4

CVE-2020-9038 Public exploit

Cross-site Scripting in Joplin

Joplin through 1.0.184 allows Arbitrary File Read via XSS.

joplin npm

Feb 17, 2020
Medium 6.1

CVE-2016-1000229 Public exploit

Improper Neutralization of Input During Web Page Generation in swagger-ui

swagger-ui has XSS in key names

swagger-ui npm

Dec 20, 2019
Medium 6.1

CVE-2017-18635 Public exploit

Cross-Site Scripting in @novnc/novnc

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

novnc @novnc/novnc novnc Debian Ubuntu npm

Sep 25, 2019
Medium 6.5

CVE-2019-5786 Exploited Public exploit EPSS 61%

Use-After-Free in puppeteer

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine npm

Jun 27, 2019
KEV May 23, 2022
Medium 6.1

CVE-2019-11358 Public exploit EPSS 87%

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems

Apr 19, 2019
Medium 6.1

CVE-2019-8331 Public exploit EPSS 16%

Bootstrap Vulnerable to Cross-Site Scripting

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Feb 20, 2019
Medium —

CVE-2018-16492 Public exploit

Prototype Pollution in extend

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

HackerOne extend node-extend node-extend Debian Ubuntu npm

Feb 1, 2019
Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

twitter-bootstrap3 bootstrap twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-6341 Public exploit

Cross-Site Scripting in react-dom

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x,…

Facebook react-dom react-dom npm

Dec 31, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch bootstrap Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14041 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

typo3/cms typo3/cms-core bootstrap org.webjars:bootstrap npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2015-9251 Public exploit EPSS 30%

Cross-Site Scripting (XSS) in jquery

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

ruby ceph jquery-rails jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018
Medium 6.1

CVE-2012-6708 Public exploit

Cross-Site Scripting in jquery

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018
Medium 6.1

CVE-2017-15878 Public exploit

Cross-Site Scripting in keystone

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

keystone npm

Oct 24, 2017
Medium —

CVE-2014-4671 Public exploit EPSS 22%

Rosetta-Flash JSONP Vulnerability in hapi

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

flashplugin-nonfree hapi Ubuntu npm

Jul 9, 2014
Medium —

CVE-2011-1714 Public exploit

QooxDoo XSS in Callback Parameter

Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or H…

qooxdoo npm

Apr 18, 2011
Medium —

CVE-2010-2273 Public exploit

Cross-Site Scripting in dojo

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly …

dojo dojo Debian npm

Jun 14, 2010