Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium 4.9
Invalid push request payload crashes Parse Server
parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.
-
Medium 5.4
Cross-site scripting in PostHog-js
PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Cont…
-
Medium 5.4
highlight vulnerable to cleartext transmission of sensitive information
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which …
-
Medium 5.3
Inspect method manipulation in vm2
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit o…
-
Medium 6.5
Buffer under-read in workerd
Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach() method could end up reading from the wrong location in memory while iterating over elem…
-
Medium 6.5
n8n Directory Traversal vulnerability
The n8n package 0.218.0 for Node.js allows Directory Traversal.
-
Medium 6.5
Uncaught exception in engine.io
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package…
-
Medium 5.4
Cross-site scripting in TotalJS
A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
-
Medium 4.4
@mittwald/kubernetes's secret contents leaked via debug logging
### Impact When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources. When running in a Kubernetes cluster, this might expose sens…
-
Medium 6.1
editor.md vulnerable to Cross-site Scripting
Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.
-
Medium 4.7
Cross-Site Request Forgery (CSRF) in builderio/qwik
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
-
Medium 5.4
matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user int…
-
Medium 6.5
Cross site request forgery token fixation in fastify-passport
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be b…
-
Medium 5.3
Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection
@fastify/csrf-protection is a plugin which helps protect Fastify servers against CSRF attacks. The CSRF protection enforced by the @fastify/csrf-protection library in combination with @fastify/cookie can be bypassed from network and same-site attackers under …
-
Medium 5.3
TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts
OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different sign…
-
Medium 5.2
`chainId` may be outdated if user changes chains as part of connection in @web3-react
@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an a…
-
Medium 4.3
Path traversal vulnerability in gatsby-plugin-sharp
gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Ga…
-
Medium 6.8
GovernorCompatibilityBravo may trim proposal calldata
OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes …
-
Medium 5.0
matrix-js-sdk vulnerable to invisible eavesdropping in group calls
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affect…
-
Medium 5.3
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
-
Medium 6.5
Directus API vulnerable to denial of service
An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
-
Medium 6.1
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe>src parameter.
-
Medium 6.1
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.
-
Medium 5.3
angular vulnerable to regular expression denial of service via the angular.copy() utility
Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large careful…
-
Medium 5.3
angular vulnerable to regular expression denial of service via the <input type="url"> element
Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is p…
-
Medium 5.3
angular vulnerable to regular expression denial of service via the $resource service
Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted inpu…
-
Medium 6.1
keycloak-connect contains Open redirect vulnerability in the Node.js adapter
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
-
Medium 4.2
directus vulnerable to Insertion of Sensitive Information into Log File
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…
-
Medium 6.1
Server-Side Request Forgery in Request
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer suppo…
-
Medium 4.3
Extract password hashes through export querying in directus
Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `password` field in `directus_users` can extract the argon2 password hashes by brute forcing the export functionality co…
-
Medium 6.9
SketchSVG Arbitrary Code Injection vulnerability
All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.
-
Medium 5.5
json-logic-js logic.js command injection
A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address thi…
-
Medium 6.5
Vega `scale` expression function cross site scripting
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression…
-
Medium 6.5
Vega has cross-site scripting vulnerability in `lassoAppend` function
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend' function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd …
-
Medium 5.4
RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters
RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users …
-
Medium 5.0
Directus vulnerable to Server-Side Request Forgery On File Import
Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security control…
-
Medium 6.5
OpenZeppelin Contracts contains Incorrect Calculation
OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the recei…
-
Medium —
Vega vulnerable to arbitrary code execution when clicking href links
Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.
-
Medium 6.1
@braintree/sanitize-url Cross-site Scripting vulnerability
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
-
Medium 6.1
Baremetrics date range picker vulnerable to Cross-site Scripting
The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who is ab…