Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Low 3.7
ircdkit vulnerable to Denial of Service due to unhandled connection end event
Versions of `ircdkit` 1.0.3 and prior are vulnerable to a remote denial of service. ## Recommendation Upgrade to version 1.0.4.
-
Medium —
Memory Exposure in concat-stream
Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()` Versions <1.3.0 are not affected due to not using unguarded Buffer constructor. ## Recommendation Update to version 1.5.2, 1.4.11, 1.3.…
-
Medium —
Memory Exposure in tunnel-agent
Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number. Proof-of-concept: ```js require('request')({ method: 'GET', uri: 'http://www.example.com', tun…
-
High —
Cross-Site Scripting in react-svg
Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default. ## Recommendation Update to version 2.2.18 or later.
-
High —
Out-of-bounds Read in base64-url
Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input. ## Recommendation Update to version 2.0.0 or later.
-
Low —
Cross-Site Scripting in public
All versions of `public` are vulnerable to stored cross-site scripting (XSS). ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
-
High 7.5
Path Traversal in angular-http-server
Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal. ## Recommendation Update to version 1.4.4 or later.
-
High 7.3
Prototype Pollution in deap
Versions of `deap` before 1.0.1 are vulnerable to prototype pollution. ## Recommendation Update to version 1.0.1 or later.
-
High 7.5
Denial of Service in foreman
All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path. ## Recommendation Upgrade to version 3.0.1.
-
High —
Cross-Site Scripting in bracket-template
All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template. ## Recommendation No fix is currently available for this vulnerability. It is our …
-
High 7.5
Improper Key Verification in ipns
Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid. ## Recommendation Update to version 0.1.3 or later.
-
Low 3.3
Insecure Credential Storage in web3
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this …
-
Medium —
Cross-Site Scripting in bootbox
All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript. ## Recommendation Sanitize user input being passed…
-
High —
Directory Traversal in ltt.js
Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private fil…
-
Medium —
Reflected Cross-Site Scripting in jquery.terminal
Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious …
-
High —
Server-Side Request Forgery in terriajs-server
Versions of `terriajs-server`prior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by th…
-
Medium —
Out-of-bounds Read in concat-with-sourcemaps
Versions of `concat-with-sourcemaps` before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator. ## Recommendation Update to version 1.0.6 or later.
-
Medium 6.1
Cross-Site Scripting in shave
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
-
Medium —
Cryptographically Weak PRNG in generate-password
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. ## Recommendation Update to version 1.4.1 or later.
-
Medium —
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure. Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password. Only `mysql` running on Node.js versions below…
-
Medium 6.3
Cross-Site Scripting in webpack-bundle-analyzer
Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting. ## Recommendation Upgrade to version 3.3.2 or later.
-
Medium 6.1
Cross-Site Scripting in simditor
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
-
Medium 6.1
Cross-site Scripting in remarkable
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
-
High 7.5
Regular Expression Denial of Service in remarkable
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
-
Medium 5.3
Unauthorized File Access in harp
Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
-
Medium 5.3
Unauthorized File Access in harp
Path traversal using symlink in npm harp module versions <= 0.29.0.
-
High 7.5CVE-2019-10742 Public exploit
Denial of Service in axios
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
-
High 7.5
Improper Input Validation and Buffer Over-read in mqtt-packet
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
-
High 7.5
Improper Input Validation in tar-fs
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink.…
-
High 7.5
Arbitrary File Overwrite in tar
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file …
-
Medium 6.1
Cross-site Scripting in NodeBB
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
-
Medium 6.1
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…
-
High 7.7
Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to …
-
High 7.5
SQL Injection in sequelize
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
-
Medium 6.1
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation
In Materialize through 1.0.0, XSS is possible via the Toast feature.
-
Medium 6.1
Materialize-css vulnerable to Cross-site Scripting in autocomplete component
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
-
Medium 6.1
Materialize-css vulnerable to Cross-site Scripting in tooltip component
In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
-
High —
Path Traversal in http-live-simulator
Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a remote attacker.
-
High —
Cross-Site Scripting in buttle
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
-
Medium 6.1
Moderate severity vulnerability that affects total.js
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).