Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
High 8.7
Forgeable Public/Private Tokens in jws
Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use…
-
Critical —
Command Injection in gm
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary. ## Recommendati…
-
Medium 5.3
Regular Expression Denial of Service in bleach
All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an upd…
-
High 7.5
Denial of Service in yar
Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value. When an invalid encryped session cookie value is provided, the process will crash. ## Recommendation Update to version 2.2…
-
Critical 9.8
Prototype Pollution
All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.
-
Critical 9.8
Prototype Pollution
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
-
Critical 9.8
Prototype Pollution
All versions of package gedi are vulnerable to Prototype Pollution via the set function.
-
Critical 9.8
Prototype Pollution
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.
-
Critical 9.8
Prototype Pollution
All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
-
Critical 9.8
Prototype Pollution
All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.
-
Critical 9.8
Prototype Pollution
All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.
-
Critical 9.8
Prototype Pollution
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
-
Critical 9.8
Prototype Pollution
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
-
Critical 9.8
Prototype Pollution
All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
-
Critical 9.8
Prototype Pollution
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
-
Critical 9.8
Prototype Pollution
All versions of package confucious are vulnerable to Prototype Pollution via the set function.
-
Critical 9.8
Prototype Pollution
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
-
Critical 9.8
Prototype Pollution
All versions of package deeps are vulnerable to Prototype Pollution via the set function.
-
Critical 9.8
Prototype Pollution
All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
-
High 7.5
Regular Expression Denial of Service in validator
Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method. ## Recommendation Update to version 3.22.1 or later.
-
Critical —
Command Injection in ungit
Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter. ## Recommendation Update version 0.9.0 or later.
-
Medium 5.3
Directory Traversal in nhouston
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory. ## Recommendation It is recommended that a different module be used, as we…
-
Medium 6.5
CSRF Vulnerability in jquery-ujs
Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an ancho…
-
High 8.2
Unauthenticated Remote Command Injection in ep_imageconvert
ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert <= 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. ## Recommendation Update to version 0.0.3 or g…
-
Medium 6.5
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking …
-
High 7.2
Command Injection
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
-
Critical —
Server secret was included in static assets and served to clients
### Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface (which is unprotected and ALLOWS arbitrary code exe…
-
Medium 6.8
XSS due to lack of CSRF validation for replying/publishing
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
-
High 7.5
Improper exception handling in Aedes
An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.
-
Medium —
Expo on iOS is insecure due incorrect security attribute application
secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
-
High 8.7
Cross-Site Scripting in highcharts
Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they clic…
-
High 8.1
Sandbox Escape
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
-
Medium 6.4
DOM-based XSS in auth0-lock
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
-
Critical 9.8
Prototype Pollution
The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
-
Critical 9.8
Prototype Pollution
The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
-
Critical 9.8
Prototype Pollution
The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
-
Critical 9.1
Server-Side Request Forgery in ftp-srv
ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be…
-
Critical 9.8
Prototype Pollution
The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
-
Critical 9.8
Prototype Pollution
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
-
Critical 9.8
Prototype Pollution
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.