Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium 6.1
XSS in knockout
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
-
Medium 6.1CVE-2016-1000229 Public exploit
Improper Neutralization of Input During Web Page Generation in swagger-ui
swagger-ui has XSS in key names
-
Medium —
Path Traversal in statics-server
A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
-
Medium 6.1
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
-
Medium 4.2
Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…
-
Medium 5.4
GitBook allows Cross-site Scripting via a local .md file.
GitBook through 2.6.9 allows XSS via a local .md file.
-
Medium 5.3
Validation bypass is possible in Json Pattern Validator
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payl…
-
Medium 6.1
Cross-Site Scripting in iobroker.web
Characters in the GET url path are not properly escaped and can be reflected in the server response.
-
Medium 4.8
XSS in Pannellum from 2.5.0 through 2.5.4
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The mos…
-
Medium 4.4
cookie-signature Timing Attack
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slpjs
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP con…
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork fro…
-
Medium 5.3
Pomelo allows external control of critical state data
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via …
-
Medium 6.1
hexo-admin plugin for Node.js XSS Vulnerability
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.
-
Medium 5.4
Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
-
Medium 6.1CVE-2017-18635 Public exploit
Cross-Site Scripting in @novnc/novnc
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
-
Medium 6.1
Cross-Site Scripting in dompurify
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
-
Medium 5.3
Path Traversal in statichttpserver
A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.
-
Medium 6.1
Cross-Site Scripting in webtorrent
WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.
-
Medium 6.1
Status Board vulnerable to Cross-Site Scripting before v1.1.82
Status Board 1.1.81 has reflected XSS via dashboard.ts.
-
Medium 6.1
Cross-Site Scripting in cyberchef
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
-
Medium 6.1
Cross-Site Scripting in status-board
Status Board 1.1.81 has reflected XSS via logic.ts.
-
Medium 6.1
Cross-Site Scripting in selectize-plugin-a11y
selectize-plugin-a11y before 1.1.0 has XSS via the msg field.
-
Medium 6.5
Denial of Service in rgb2hex
All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value. ## Recommendation Update to version 0.1.6 or later.
-
Medium 5.9
Invalid Curve Attack in openpgp
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
-
Medium 5.5
MySQL for Node.js Unsafe Options
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
-
Medium 6.1
Cross-Site Scripting (XSS) in Verdaccio
verdaccio before 3.12.0 allows XSS.
-
Medium 6.1
Cross-site Scripting in pandao
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
-
Medium 6.1
Cross-site Scripting in pandao editor.md
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
-
Medium 5.4
Cross-Site Scripting in min-http-server
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Medium 5.4
Cross-Site Scripting in http-file-server
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Medium 5.3
Sensitive Data Exposure in parse-server
parse-server before 3.6.0 allows account enumeration.
-
Medium 6.1
AntSword RCE and XSS via code injection
In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
-
Medium 6.5
Regular Expression Denial of Service (ReDoS) in lodash
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regula…
-
Medium —
XSS in TinyMCE
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media eleme…
-
Medium 5.3
Path Traversal in http-file-server
A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.
-
Medium 6.1
Cross-Site Scripting in @nuxt/devalue
@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.
-
Medium 5.3
Path Traversal in serve-here.js
Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.
-
Medium 5.1
Denial of Service in mem
Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abus…
-
Medium 6.1
mxGraph vulnerable to cross-site scripting in color field
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/graph…