Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8
Prototype Pollution
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
-
Critical 9.8
Prototype Pollution
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
-
High —
Cross-Site Scripting in @progress/kendo-angular-editor
Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding …
-
High —
Cross-site scripting vulnerability in TinyMCE
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
-
Critical 9.8
Validation bypass in jpv
jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
-
High 7.1
Cross-Site Scripting in Prism
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v…
-
Medium 5.0
XSS via JQLite DOM manipulation functions in AngularJS
### Summary XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `ang…
-
Medium 6.8
CSRF Vulnerability in polaris-website
### Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't chec…
-
Medium 6.7
CSRF vulnerability in save-server
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patche…
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLPJS
In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child…
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLP Validate
In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly val…
-
Medium —
Denial of service in fastify
A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
-
High 7.5CVE-2020-7699 Public exploit
Prototype Pollution
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
-
High 7.7
Authorization header is not sanitized in an error object in auth0
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header …
-
High 7.2
Command Injection in git-tags-remote
All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the…
-
Critical 9.8
Command Injection
This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON…
-
High 7.5
Directory Traversal
This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
-
High 7.5
Directory Traversal
This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
-
High 7.5
Directory Traversal
This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
-
Medium 5.5CVE-2020-8175 Public exploit
Uncontrolled resource consumption in jpeg-js
Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.
-
Medium —
Storing Password in Local Storage
The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time tha…
-
Medium 6.5
Information disclosure through Viewer query in parse-server
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
-
Medium 6.5
Android WebView Universal Cross-site Scripting
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page.
-
High 7.5
Improper Input Validation in sails-hook-sockets
Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
-
Critical 9.3
Command injection in codecov (npm package)
In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE…
-
Medium 6.1CVE-2020-7680 Public exploit
Cross-site Scripting in docsify
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after th…
-
High 7.5
Path traversal in servey
A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.
-
High 8.8
Buffer overflow in canvas
A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image.
-
High 7.5
Server-Side Request Forgery in @uppy/companion
The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
-
Medium 5.3
Information Exposure
This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentia…
-
High 7.5
Directory Traversal
This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
-
Critical 9.8
Remote Code Execution in scratch-vm
MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is ex…
-
High 7.5
Path Traversal in socket.io-file
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.
-
Medium 5.6
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…
-
High 7.4CVE-2020-8203 Public exploit
Prototype Pollution in lodash
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
-
Medium —
Command Injection in standard-version
# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111` The [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-versio…
-
Critical 9.8
Injection and Command Injection in devcert
A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.