Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Medium 5.3
Directus version number disclosure
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious…
-
High 8.2
Directus MySQL accent insensitive email matching
Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address…
-
Medium 6.1
mongo-express Cross-site Request Forgery vulnerability
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
-
Critical 9.8CVE-2024-22891 Public exploit
Nteract Remote Code Execution vulnerability
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.
-
Medium 6.5
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory …
-
Critical 9.1
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
### Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key `535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe`. This exposes users to potential loss of funds on ledgers and unauthorized acc…
-
Medium 5.3
Showdownjs Denial of Service
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
-
None 0.0CVE-2024-27088 Public exploit
es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`
es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
-
Medium 5.3
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit t…
-
High 8.7
`@backstage/backend-common` vulnerable to path traversal through symlinks
`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPat…
-
Critical 9.1
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the li…
-
High 8.4
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative act…
-
High 7.5
electron-pdf 20.0.0 - Local File Read via Server Side XSS
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.
-
Medium 6.1
Cross-site Scripting in Serenity
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
-
Medium 6.5
Backpressure request ignored in fetch() in Undici
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are…
-
Low 3.9
Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advis…
-
High 8.3
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`
# GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219` The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [scrypted](https://github.com/koush/scrypted). We…
-
High 7.3CVE-2024-25466 Public exploit
React Native Document Picker Directory Traversal vulnerability
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
-
High 7.7
Path traversal vulnerability in mapshaper
The attacker may exploit a path traversal vulnerability leading to information disclosure.
-
Low 3.5
dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redos
A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality of the file packages/json-deserializer/src/JsonDeserializer.ts of the component…
-
Medium 6.5CVE-2024-23724 Public exploit
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer rep…
-
High 7.5CVE-2024-21490 Public exploit
angular vulnerable to super-linear runtime due to backtracking
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-craf…
-
Medium 6.6
Local Privilege Escalation in execuatables bundled by pkg
pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg` are written to a hardcoded directory. On unix systems, this is `/tmp/pkg/*` which is a shared directory for all users on the same local system. There is…
-
Critical 9.8
NPM IP package incorrectly identifies some private IP addresses as public
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
-
Medium 6.1CVE-2024-24816 Public exploit
Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in t…
-
Medium 6.1
CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-p…
-
Critical 9.8CVE-2024-24398 Public exploit
Stimulsoft Dashboard.JS directory traversal vulnerability
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.
-
Medium 5.4CVE-2024-24397 Public exploit
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.
-
Medium 6.1CVE-2024-24396 Public exploit
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the search bar component.
-
High 7.7
Yarn: untrusted search path
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
-
Medium —
Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images
### Impact A major blind SSRF has been found in `remark-images-download`, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private n…
-
Low —
Local File Inclusion vulnerability in zmarkdown
### Impact A minor Local File Inclusion vulnerability has been found in `zmarkdown`, which allowed for images with a known path on the host machine to be included inside a LaTeX document. To prevent it, a new option has been created that allow to replace inva…
-
Medium 6.5CVE-2024-21485 Scanner template
Dash apps vulnerable to Cross-site Scripting
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-com…
-
High 7.5
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
-
Medium 5.3
Lobe Chat unauthorized access to plugins
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper autho…
-
High 8.2
react-query-streamed-hydration xss
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would ne…
-
High 7.2
XSS in @urql/next
urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed…
-
High 8.2
XSS in @apollo/experimental-nextjs-app-support
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inje…
-
High 7.3
network Arbitrary Command Injection vulnerability
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, i…
-
Critical 9.8
Ylianst MeshCentral Missing SSL Certificate Validation
Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.