Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
High 8.8
pym.js CSRF Vulnerability
NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript…
-
High 8.1
tiny-json-http missing SSL certificate validation
brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the use…
-
High 8.8
Electron protocol handler browser vulnerable to Command Injection
Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their brow…
-
High 8.8
Auth0-js bypasses CSRF checks
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
-
High 7.5
Regular Expression Denial of Service in moment
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
-
High 7.5
AWS Lambda parser is vulnerable to Regular Expression Denial of Service
index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
-
Medium 5.9
Regular Expression Denial of Service in ssri
index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.
-
Critical 9.8
mxGraph vulnerable to XXE attacks
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
-
High 7.8
Incorrect Permission Assignment for Critical Resource in NPM
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow lo…
-
Medium 5.3
Converse.js Exposure of Sensitive Information
Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that …
-
Medium 5.3
Insight API transaction broadcast endpoint can result in Full Path Disclosure
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
-
Critical 9.8
Etherpad Lite Access Restriction Bypass
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
-
Medium 6.1
dijit editor cross-site scripting vulnerability
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
-
Medium 6.1
Simditor XSS Vulnerability
Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
-
High 7.5
ReDoS in brace-expansion
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.
-
High 8.8
Remote Code Execution in electron
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitra…
-
High 7.5CVE-2018-6184 Scanner template
Directory traversal vulnerability in Next.js
ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.
-
Medium 6.1
Cross-Site Scripting (XSS) in jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
-
Medium 6.1CVE-2012-6708 Public exploit
Cross-Site Scripting in jquery
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…
-
High 7.5
Denial of Service in jquery
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
-
High 7.5
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (J…
-
Medium 6.1
Shiba vulnerable to XSS leading to code execution
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.
-
Medium 6.1
Marked vulnerable to XSS from data URIs
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
-
Medium 4.3
Electron vulnerable to URL spoofing via PDFium
Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.
-
High 7.8
fs-git command injection vulnerability
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across al…
-
High 7.5
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
-
Medium 6.5
Denial of Service in mqtt
MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.
-
High 8.1
passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign th…
-
High 7.5
Denial of Service in ecstatic
A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
-
High 7.5
auth0-js Privilege Escalation Vulnerability
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application use…
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
-
High —
Arbitrary JavaScript Execution in typed-function
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
High 7.5
jqueryFileTree vulnerable to Directory Traversal
jqueryFileTree 2.1.5 and older Directory Traversal
-
High 7.5
Next.js Directory Traversal Vulnerability
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
-
High 7.5
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
-
Critical 9.8
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
-
Medium 6.1
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
-
Critical 9.8
PIDUsage Enables OS Command Injection
soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution
-
Critical 9.8
Command Execution in windows-cpu
npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user