Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
High 7.5
Improper Key Verification in openpgp
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
-
High 7.5CVE-2019-9153 Public exploit
Message Signature Bypass in openpgp
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
-
High 7.5
assign-deep Vulnerable to Prototype Pollution
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
-
Medium 5.5
MySQL for Node.js Unsafe Options
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
-
Medium 6.1
Cross-Site Scripting (XSS) in Verdaccio
verdaccio before 3.12.0 allows XSS.
-
Medium 6.1
Cross-site Scripting in pandao
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
-
Medium 6.1
Cross-site Scripting in pandao editor.md
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
-
Medium 5.4
Cross-Site Scripting in min-http-server
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
Medium 5.4
Cross-Site Scripting in http-file-server
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
-
High 8.1
Missing Encryption of Sensitive Data in yarn
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
-
Medium 5.3
Sensitive Data Exposure in parse-server
parse-server before 3.6.0 allows account enumeration.
-
High 7.5
Parse Server before v3.4.1 vulnerable to Denial of Service
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
High 7.3
Auth0 Passport-SharePoint does not validate JWT signature
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
-
Medium 6.1
AntSword RCE and XSS via code injection
In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
-
Medium 6.5
Regular Expression Denial of Service (ReDoS) in lodash
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regula…
-
Medium —
XSS in TinyMCE
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media eleme…
-
Medium 5.3
Path Traversal in http-file-server
A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.
-
Medium 6.1
Cross-Site Scripting in @nuxt/devalue
@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.
-
Medium 5.3
Path Traversal in serve-here.js
Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.
-
Medium 5.1
Denial of Service in mem
Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abus…
-
High —
Path Traversal in serve-here.js
Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. ## Recommendation Upgrade to version 1.2.0 or later.
-
High 7.5
Arbitrary File Overwrite in fstream
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted f…
-
Medium 6.1
mxGraph vulnerable to cross-site scripting in color field
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/graph…
-
Medium —
Cross-Site Scripting via JSONP
JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
-
Medium 6.5
Arbitrary Code Injection in mobile-icon-resizer
mobile-icon-resizer resizes large images for use as icons for iOS and Android. mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3. mobile-icon-resizer takes an options object as an argument to define the resulting icons as such: `…
-
Medium 6.5
Use-After-Free in puppeteer
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
KEV May 23, 2022 -
Critical —
Command Injection in open
Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in. The package does come with the following warning in the readme: ``` The same care should be taken when calling open as if you were calling child_proc…
-
Medium 4.3
Reverse Tabnapping in swagger-ui
Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is…
-
Medium —
Regular Expression Denial of Service
A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.
-
High 7.5
Directory Traversal in lactate
A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on …
-
Medium —
Regular Expression Denial of Service in underscore.string
Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS). The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows …
-
Critical 10.0
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution. ## Recommendation Update to version 3.1.1 or later.
-
Critical —
Failure to sanitize quotes which can lead to sql injection in squel
All versions of `squel` are vulnerable to sql injection. The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed. Proof of concept demonstrati…
-
High 7.3
Prototype Pollution in @apollo/gateway
Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 4.18.2 o…
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
High —
Cross-Site Scripting in ids-enterprise
Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …
-
Medium 6.5
Command Injection in wiki-plugin-datalog
Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system. ## Recommendation…
-
High —
Regular Expression Denial of Service (ReDoS)
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.