Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium 5.9
pubnub Insufficient Entropy vulnerability
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions …
-
Medium 6.1CVE-2023-49293 Scanner template
Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module…
-
Medium 4.0
Information leak in nodejs-firestore
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend u…
-
Medium 6.3
Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics …
-
Medium 6.1
ASAR Integrity bypass via filetype confusion in electron
Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabl…
-
Medium —
Uptime Kuma Authenticated remote code execution via TailscalePing
### Summary The `runTailscalePing` method of the `TailscalePing` class injects the `hostname` parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. ### Details When adding a new monitor o…
-
Medium 5.3
next-auth vulnerable to possible user mocking that bypasses basic authentication
NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-…
-
Medium 5.9CVE-2023-48223 Public exploit
fast-jwt JWT Algorithm Confusion
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match …
-
Medium 5.3
Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate…
-
Medium 5.3
@vendure/core's insecure currencyCode handling allows wrong payment amounts
### Impact Currently, in many Vendure deployments it's possible to select any currencyCode (really any, doesn't need to be assigned to the channel) and pay through Mollie and Stripe in that particular currencyCode. The prices are not transformed. The result i…
-
Medium 5.3
Denial of Service of regular expression in package @adobe/css-tools
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.
-
Medium 6.1
Cross-Site Scripting vulnerability in CKSource CKEditor
A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information.
-
Medium 6.1
Special characters in unescaped text nodes can trigger mXSS in TinyMCE
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization accordi…
-
Medium 5.6
chromedriver Command Injection vulnerability
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An…
-
Medium 5.4
NASA Open MCT Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.
-
Medium 6.5
NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.
-
Medium 6.5CVE-2023-45857 Public exploit
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
-
Medium 6.1CVE-2023-46998 Public exploit
Bootbox.js Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.
-
Medium 6.1
DOMPurify Open Redirect vulnerability
DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.
-
Medium 6.5
browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures t…
-
Medium 6.1
Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin
TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a stri…
-
Medium 6.1
Cross-site Scripting vulnerability in TinyMCE notificationManager.open API
TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions f…
-
Medium 5.9
Directus crashes on invalid WebSocket message
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this …
-
Medium 6.5
React Developer Tools extension Improper Authorization vulnerability
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived f…
-
Medium 6.5
SQL Injection in nocodb
Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given…
-
Medium 4.7
Allocation of Resources Without Limits or Throttling in vriteio/vrite
Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.
-
Medium 6.5
Improper Input Validation in vriteio/vrite
Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.
-
Medium 6.7
Uptime Kuma has Persistentent User Sessions
Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity perio…
-
Medium 5.3
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by Po…
-
Medium 6.1
quill-mention Cross-site Scripting vulnerability
Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:** If the mentions list is sourced from unsafe (user-sourced) data, this might allow a…
-
Medium 5.7
Improper Input Validation in nocodb/nocodb
Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
-
Medium 5.3CVE-2023-26144 Public exploit
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade sys…
-
Medium 6.5
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command…
-
Medium 6.1
Jodit Editor vulnerable to cross-site scripting
Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.
-
Medium 6.8
Strapi's field level permissions not being respected in relationship title
Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to …
-
Medium 5.8
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove privat…
-
Medium 5.4
Froala Editor Cross-site Scripting vulnerability
Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 5.3
Buttercup allows attackers to obtain the hash of the master password
Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/
-
Medium 6.0
Context isolation bypass via nested unserializable return value in Electron
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main…
-
Medium 6.1
Electron: Out-of-package code execution when launched with arbitrary cwd
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following condition…