Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
High 7.5
Prototype pollution in controlled-merge
Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
High 7.5
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in CKEditor4
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
-
High —
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist …
-
Critical 9.8
Prototype Pollution in deephas
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in object-hierarchy-access
Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype Pollution in field
Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Medium 6.5
Prototype Pollution
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
-
High 8.6
Command Injection
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
-
High 7.5
Prototype Pollution
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
-
High 7.5
Prototype pollution in @strikeentco/set
Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
High 7.3
Prototype Pollution
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target obj…
-
High 7.5
Prototype pollution in json8-merge-patch
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
-
Medium 5.9
Web Cache Poisoning
This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed head…
-
Medium 5.9
Axios vulnerable to Server-Side Request Forgery
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
-
Medium 6.1CVE-2020-28249 Public exploit
Cross-site scripting in Joplin
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
-
High 7.5
Arbitrary File Read
This affects the package phantom-html-to-pdf before 0.6.1.
-
Medium 6.5
Arbitrary File Read
This affects the package jsreport-chrome-pdf before 1.10.0.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
-
High 7.5
Path Traversal
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary f…
-
Medium 6.5
Path Traversal
This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/ja…
-
High 7.5
Prototype Pollution
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this …
-
High —
xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion
### Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. ### Patches Version 2.0.0 has the fix. ### Workarounds The recommendation is to upgrade. In case tha…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
-
High 7.5
Out-of-bounds Read in Facebook Hermes
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this i…
-
High 8.8
Command Injection
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
-
Medium 6.0
Prototype Pollution
pathval before version 1.1.1 is vulnerable to prototype pollution.
-
Medium 4.3
Improper session expiration in Parse Server
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with in…
-
Critical 9.8
Authorization bypass in Strapi
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
-
High 7.5
Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
-
Medium 5.4
Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
-
Critical 9.6CVE-2020-7750 Public exploit
Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
-
High 7.6
Server-side Request Forgery (SSRF)
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It wi…
-
Medium 5.6
Prototype Pollution
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a prog…
-
Medium 6.3
Cross-site Scripting (XSS)
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
-
High 7.7
Prototype pollution in object-path
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new i…