Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Medium 6.1CVE-2016-1000229 Public exploit
Improper Neutralization of Input During Web Page Generation in swagger-ui
swagger-ui has XSS in key names
-
Medium —
Path Traversal in statics-server
A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
-
Critical 9.8
Command Injection in node-df
A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
-
Critical 9.8
Treekill Enables OS Command Injection
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
-
High —
Command Injection in tree-kill
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
-
High 7.5
Cross-Site Scripting in http_server
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
-
High 7.8
Yarn Improper link resolution before file access (Link Following)
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
-
High 7.7
Arbitrary File Overwrite in npm CLI
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a se…
-
High 7.7
Unauthorized File Access in npm CLI before before version 6.13.3
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow …
-
High 7.7
Unauthorized File Access in npm CLI before before version 6.13.3
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…
-
High 8.8
lodahs is malware
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
-
High 7.5
bson-objectid contains Improper input validation
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it det…
-
Medium 6.1
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
-
Low —
methodOverride Middleware Reflected Cross-Site Scripting in connect
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
-
Low 3.1
regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-js
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.j…
-
Critical 9.8
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError.
-
High 7.2
Command Injection in strapi
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be execute…
-
Medium 4.2
Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…
-
Medium 5.4
GitBook allows Cross-site Scripting via a local .md file.
GitBook through 2.6.9 allows XSS via a local .md file.
-
Medium 5.3
Validation bypass is possible in Json Pattern Validator
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payl…
-
Medium 6.1
Cross-Site Scripting in iobroker.web
Characters in the GET url path are not properly escaped and can be reflected in the server response.
-
Medium 4.8
XSS in Pannellum from 2.5.0 through 2.5.4
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The mos…
-
Critical 9.1
Cross-Site Scripting in vant
Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 2…
-
High 7.5
Arbitrary File Write in iobroker.js-controller
An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to…
-
Critical 9.8
Arbitrary File Write in iobroker.admin
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
-
High 7.5
angular Prototype Pollution vulnerability
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
-
Medium 4.4
cookie-signature Timing Attack
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slpjs
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP con…
-
Medium 5.7
Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork fro…
-
Medium 5.3
Pomelo allows external control of critical state data
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via …
-
High 7.3
Prototype Pollution in chartkick
Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.
-
High —
Default Express middleware security check is ignored in production
## Default Express middleware security check is ignored in production ### Impact All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected. ### Pat…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
High 7.5CVE-2019-17221 Public exploit
PhantomJS Arbitrary File Read
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An at…
-
Critical 9.8
SQL Injection in sequelize
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
-
High 7.5
Cezerin Unauthorized Acces
Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or s…
-
Critical 9.8
SQL Injection in sequelize
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
-
Low 3.7
SQL Injection and Cross-site Scripting in class-validator
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk …
-
Medium 6.1
hexo-admin plugin for Node.js XSS Vulnerability
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.
-
Critical 9.8
Sandbox Breakout in realms-shim
Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed …