Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Medium 6.1
rendertron XSS vulnerability
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
-
Medium 5.3
Path Traversal in simplehttpserver
A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.
-
Critical 9.8
Critical severity vulnerability that affects event-stream and flatmap-stream
The NPM package `flatmap-stream` is considered malicious. A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`. Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`…
-
Critical 9.8CVE-2018-9207 Public exploit
Unrestricted Upload of File with Dangerous Type in jquery-file-upload
Arbitrary file upload in jQuery Upload File <= 4.0.2
-
Medium 6.1
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
-
Medium 6.1
Ckeditor XSS Vulnerability
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
-
High 7.5
Denial of Service in ethereumjs-vm
ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute. NOTE: the vendor disputes this because REVERT is a normal bytecode that can be triggered from high-level sou…
-
Medium 6.1
SimpleMDE XSS Vulnerability
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
-
Medium 6.1
Pandao editor.md vulnerable to DOM XSS
pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
-
High 7.5
Path Traversal in knightjs
A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
-
Medium 5.3
Path Traversal in takeapeek
A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.
-
Medium 6.1
Stored Cross-Site Scripting in tianma-static
A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.
-
High 7.5
Prototype Pollution in cached-path-relative
A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.
-
Critical 10.0
Command Injection in apex-publish-static-files
A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a maliciously crafted argument.
-
High 7.5
Prototype Pollution in merge
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
-
Medium —
Command Injection in libnmap
A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options.
-
Medium 6.1
Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
-
Critical 9.8
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
-
Medium 5.4
Cross-site Scripting in yapi-vendor
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
-
High 7.5
Missing Origin Validation in webpack-dev-server
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive…
-
High 7.5
Missing Origin Validation in parcel-bundler
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR me…
-
High 7.5
Missing Origin Validation in browserify-hmr
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSo…
-
Medium 5.5
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
-
Critical 9.8
ps Enables OS Command Injection
A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.
-
Medium 6.1
Cross-Site Scripting in exceljs
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.
-
Medium 5.3
ReDoS via long string of semicolons in tough-cookie
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …
-
Medium 6.1
Pandao editor.md vulnerable to XSS in IMG attributes
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
-
High 7.5
simplehttpserver allows directory traversal and file listing
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
-
High 7.5
Mosca REDoS Vulnerability
This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can…
-
Critical 9.8
Command Injection in egg-scripts
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
-
High 8.1
Electron webPreferences vulnerability can be used to perform remote code execution
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code executio…
-
Critical 9.8
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
-
Critical 9.8
Code Injection in cryo
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.
-
Critical 9.8
Command Injection in git-dummy-commit
A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
-
Critical 9.8CVE-2018-3783 Public exploit
Privilege Escalation due to Blind NoSQL Injection in flintcms
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
-
Critical 10.0
Open Redirect in url-parse
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
-
Medium 5.3
Improper Authorization in aedes
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
-
Medium 6.1
metascraper before v5.2.0 vulnerable to stored cross-site scripting
There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.
-
Critical 9.8
Command Injection in whereis
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.
-
High —
Path Traversal in superstatic
Affected of `superstatic` are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a kn…