Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
High 8.8CVE-2017-16570 Public exploit
Cross-Site Request Forgery (CSRF) in keystone
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
-
Medium 4.8
Cross-Site Scripting in keystone
Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878.
-
Medium 6.1CVE-2017-15878 Public exploit
Cross-Site Scripting in keystone
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
-
High 8.8CVE-2017-15879 Public exploit
Keystone is vulnerable to CSV injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.
-
High 8.1
Potential Command Injection in codem-transcode
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
-
High 7.5
Directory Traversal in st
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
-
Critical 9.8
Potential Command Injection in printer
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
-
High 7.5
Regular Expression Denial of Service in tough-cookie
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CP…
-
Medium 6.1
NodeBB Cross-site Scripting Vulnerability in Markdown Processing
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
-
High 7.5
LDAP Injection in ldapauth
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
-
Medium 6.1
No Charset in Content-Type Header in express
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non…
-
High 8.1
Electron vulnerable to remote command execution
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a preconditi…
-
High 7.5
OpenPGP 1.2.0 and earlier decrypts arbitrary messages
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP me…
-
Medium 6.1
Content Injection via TileJSON Name in mapbox.js
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
-
High 7.5
Prototype Pollution Protection Bypass in qs
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
-
Medium 6.1
Cross Site Scripting (XSS) in plotly.js
Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
-
Medium 6.1
Content Injection via TileJSON attribute in mapbox.js
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
-
Critical 9.8
keycloak-connect and keycloak-js improperly handle invalid tokens
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
-
High 7.5
Information Exposure in cordova-android
Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maxim…
-
Critical —
Cross-Site Scripting in swagger-ui
Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.
-
Medium 6.1CVE-2016-7103 EPSS 29%
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
-
Medium 6.1
EpicEditor XSS Vulnerability
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.
-
Medium 5.3
Cloudera HUE Account Enumeration
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
-
Critical 9.8
Code Execution Through IIFE in serialize-to-js
An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression…
-
Medium 5.9
User Impersonation in converse.js
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…
-
Critical 9.8
Code Execution through IIFE in node-serialize
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression …
-
Medium 6.1
Cross-Site Scripting in serve-index
Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.
-
Medium 6.1
Cross-Site Scripting in handlebars
The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
-
Medium 5.3
Root Path Disclosure in send
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
-
Medium 6.1
Cross-Site Scripting in mustache
mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
-
High 7.5
Regular Expression Denial of Service in marked
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
-
Critical 9.8
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly r…
-
High 7.5
Regular Expression Denial of Service in semver
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in uglify-js
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Symlink Arbitrary File Overwrite in tar
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
-
High 7.5
Regular Expression Denial of Service in ms
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
Medium 6.1
Multiple XSS Filter Bypasses in validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.
-
Medium 6.1
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
-
Medium 6.1
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
-
Medium 6.1
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.