Skip to content
OpenAdvisories

Package · npm

moment-timezone

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-56x4-j7p9-fcf9

    Command Injection in moment-timezone

    ### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the t…

    moment-timezone npm
  • Medium —
    GHSA-v78c-4p63-2j6c

    Cleartext Transmission of Sensitive Information in moment-timezone

    ### Impact * if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website * and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploi…

    moment-timezone npm