Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium —
Cross-Site Scripting via JSONP
JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
-
Medium 6.5
Arbitrary Code Injection in mobile-icon-resizer
mobile-icon-resizer resizes large images for use as icons for iOS and Android. mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3. mobile-icon-resizer takes an options object as an argument to define the resulting icons as such: `…
-
Medium 6.5
Use-After-Free in puppeteer
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
KEV May 23, 2022 -
Medium 4.3
Reverse Tabnapping in swagger-ui
Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is…
-
Medium —
Regular Expression Denial of Service
A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.
-
Medium —
Regular Expression Denial of Service in underscore.string
Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS). The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows …
-
Medium 6.5
Command Injection in wiki-plugin-datalog
Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. ## Recommendation…
-
Medium —
Out-of-bounds Read in npmconf
Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x. ## Recommendation Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as n…
-
Medium —
SQL Injection in sql
All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries. ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until…
-
Medium 4.7
Forced Logout in keycloak-connect
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF paramet…
-
Medium —
Path Traversal in m-server
Versions of `m-server` before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server. ## Recommendation Update to version 1.4.2 or later.
-
Medium —
Regular Expression Denial of Service
A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the "\s*" pattern.
-
Medium 5.6
Rate Limiting Bypass in express-brute
All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and ex…
-
Medium 4.2
Insecure Default Configuration in redbird
Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable. ## Recommendation Upgrade to version …
-
Medium —
Path Traversal in servey
Versions of `servey` prior to 3.x are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. ## Recommendation Upgrade to the latest version
-
Medium —
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
-
Medium 5.9
Insecure Default Configuration in tesseract.js
Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations. ## Recommendation U…
-
Medium 5.9
Denial of Service in js-yaml
Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. ## Recommendation Upgrade to version 3.13.0.
-
Medium —
Denial of Service in canvas
Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process. ## Recommendation Upgrade to version 1.6.10
-
Medium 5.9
Denial of Service in url-relative
All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service. ## Recommendation No fix is currently available. Consider using an alternati…
-
Medium —
Path Traversal in statics-server
All versions of `statics-server` are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. ## Recommendation No fix is currently available. Consider using an alternative module until a…
-
Medium 5.3
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. ## Recommendation Upg…
-
Medium —
Out-of-bounds Read in byte
Versions of `byte` before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length ## Recommendation Update to version 1.4.1 or later.
-
Medium 5.1
Remote Memory Exposure in floody
Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure. .write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory. Proof of Concept: ``` var f = require('floody')(pro…
-
Medium —
Memory Exposure in bl
Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure. `bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory ## Recommendation Update to version 0.9.5, 1.0.1 or l…
-
Medium —
Memory Exposure in concat-stream
Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()` Versions <1.3.0 are not affected due to not using unguarded Buffer constructor. ## Recommendation Update to version 1.5.2, 1.4.11, 1.3.…
-
Medium —
Memory Exposure in tunnel-agent
Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: ```js require('request')({ method: 'GET', uri: 'http://www.example.com', tun…
-
Medium —
Cross-Site Scripting in bootbox
All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript. ## Recommendation Sanitize user input being passed…
-
Medium —
Reflected Cross-Site Scripting in jquery.terminal
Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious …
-
Medium —
Out-of-bounds Read in concat-with-sourcemaps
Versions of `concat-with-sourcemaps` before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator. ## Recommendation Update to version 1.0.6 or later.
-
Medium 6.1
Cross-Site Scripting in shave
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
-
Medium —
Cryptographically Weak PRNG in generate-password
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. ## Recommendation Update to version 1.4.1 or later.
-
Medium —
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure. Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password. Only `mysql` running on Node.js versions below…
-
Medium 6.3
Cross-Site Scripting in webpack-bundle-analyzer
Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting. ## Recommendation Upgrade to version 3.3.2 or later.
-
Medium 6.1
Cross-Site Scripting in simditor
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
-
Medium 6.1
Cross-site Scripting in remarkable
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
-
Medium 5.3
Unauthorized File Access in harp
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
-
Medium 5.3
Unauthorized File Access in harp
Path traversal using symlink in npm harp module versions <= 0.29.0.
-
Medium 6.1
Cross-site Scripting in NodeBB
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
-
Medium 6.1
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…