Skip to content
OpenAdvisories

Vendor

HackerOne

470 known vulnerabilities.

Products

RubyGems 4 hapi node module 4 sequelize node module 4 coffeescript node module 3 serve node module 2 html-janitor node module 2 ws node module 2 Nextcloud Server 2 i18next node module 2 marked node module 2 crud-file-server node module 2 private_address_check ruby gem 2 express-cart 2 nodemailer.js node module 2 remarkable node module 2 sanitize-html node module 2 m-server 2 http-live-simulator 1 lab6drewfusbyu node module 1 install-g-test node module 1 caolilinode node module 1 ibm_db node module 1 f2e-server node module 1 webrtc-native node module 1 lodash 1 desafio node module 1 phantomjs-cheniu node module 1 sencisho node module 1 hapi-auth-jwt2 node module 1 tinyserver2 node module 1 cobalt-cli node module 1 zwserver node module 1 selenium-portal node module 1 byucslabsix node module 1 react-native-baidu-voice-synthesizer node module 1 method-override node module 1 frames-compiler node module 1 npm-script-demo node module 1 jvminstall node module 1 sync-exec node module 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 10.0
    CVE-2017-16088 Public exploit

    Sandbox Breakout in safe-eval

    The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.

    HackerOne safe-eval node module safe-eval npm
  • Critical 9.8
    CVE-2017-16082 Public exploit EPSS 10%

    Remote Code Execution in pg

    A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…

    HackerOne pg node module node-postgres pg Debian Ubuntu npm
  • Critical —
    CVE-2016-10555 Public exploit

    Forgeable Public/Private Tokens in jwt-simple

    Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…

    HackerOne jwt-simple node module jwt-simple npm
  • Critical —
    CVE-2015-9235 Public exploit

    Verification Bypass in jsonwebtoken

    In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …

    HackerOne jsonwebtoken node module jsonwebtoken npm