Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Low 3.1
Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode
TCR is temporarily miscalculated in the `batchLiquidateTroves` function during Recovery Mode. The bug lies in [`batchLiquidateTroves` of `TroveManager`](https://github.com/liquity/dev/blob/7c83ea11378454629618b3808b16fbfda69ee3e5/packages/contracts/contracts/…
-
High 8.2
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…
-
High 7.5
Improperly Controlled Modification of Object Prototype Attributes
### Impact The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. ### Patches `think-config@1.1…
-
Medium 6.1
Joplin vulnerable to Cross-site Scripting in notes
Joplin before 2.0.9 allows XSS via button and form in the note body.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
-
Medium 5.6
Prototype Pollution
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
-
Medium 6.5
Cross-site Scripting (XSS)
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
-
Medium 6.5
Misinterpretation of malicious XML input in xmldom
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may l…
-
Medium 5.3
Directory Traversal in isomorphic-git
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
-
Medium 5.3
Open Redirect in unshiftio/url-parse
url-parse is vulnerable to URL Redirection to Untrusted Site
-
Medium 5.3
Denial of Service (DoS)
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.
-
High 8.1
Command Injection
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
-
Medium 5.4
Cross-site Scripting (XSS)
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
-
Medium 5.5
Denial of Service in SheetsJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
-
Medium 5.5
Denial of Service in SheetJS Pro
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
-
Medium 5.3
Open Redirect in medialize/URI.js
URI.js is vulnerable to URL Redirection to Untrusted Site
-
High 7.5
Basic-auth app bundle credential exposure in gatsby-source-wordpress
Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication…
-
High 7.5
Improper Input Validation in is-email
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of…
-
Critical 9.8
Prototype Pollution in putil-merge
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Arbitrary Code Execution
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
-
Critical 9.8
Arbitrary Code Execution
The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
-
Medium 4.3
Xen Orchestra Mishandles Authorization
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to…
-
Critical 9.8
Prototype polluation in just-safe-set
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Medium 6.5
Utils.readChallengeTx does not verify the server account signature
js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction i…
-
High 7.3
Prototype Pollution
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
-
High 7.3
Prototype Pollution
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
-
Medium 6.5
Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…
-
High 7.5
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper
think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not proper…
-
Medium 6.3
HTTP Header Injection
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
-
High 7.4
Regular Expression Denial of Service (ReDoS) in Prism
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long ti…
-
High 7.3
Arbitrary Command Injection
This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitizat…
-
Medium 6.1
Cross-site Scripting in Mermaid
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
-
High 8.0
Reflected XSS from the callback handler's error query parameter
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query par…
-
Medium 6.1
Cross-site Scripting (XSS)
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize…
-
High 8.1
XSS Vulnerability in mongo-express
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row wi…
-
High 7.5
ReDOS in IS-SVG
A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.
-
Medium 5.3
Regular Expression Denial of Service (ReDOS)
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.
-
Low 3.7
Passing in a non-string 'html' argument can lead to unsanitized output
The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html`…