Vendor
HackerOne
470 known vulnerabilities.
Products
358 results · Clear filters · Feed
-
High 8.8
Authentication Bypass by Spoofing in express-cart
A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
-
High —
Path Traversal in simplehttpserver
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL.
-
High —
Prototype Pollution in lodash
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
-
High —
Path Traversal in http-live-simulator
Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.
-
High 7.5
mcstatic directory traversal vulnerability
A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
-
High 7.5
Prototype Pollution in mpath
A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
-
High 7.5
Prototype Pollution in merge
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
-
High 7.5
simplehttpserver allows directory traversal and file listing
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
-
High 7.5
Sprockets path traversal leads to information leak
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root di…
-
High —
private_address_check contains race condition
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public a…
-
High 8.8CVE-2018-3758 EPSS 27%
express-cart unrestricted file upload vulnerability
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
-
High 7.5
Denial of Service vulnerability with large JSON payloads in fastify
Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.
-
High 7.5
Path Traversal in localhost-now
localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in mcstatic
mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
-
High 7.5
Regular Expression Denial of Service in sshpk
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
-
High 7.5
Path Traversal in 626
626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in resolve-path
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in hekto
hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
-
High 7.5
Path Traversal in public
public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
-
High 8.8
Prototype Pollution in mixin-deep
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that …
-
High 7.5
Path Traversal in general-file-server
general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.
-
High 8.8
Prototype Pollution in defaults-deep
defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property th…
-
High 8.8
Prototype Pollution in assign-deep
assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that…
-
High 8.8
Prototype Pollution in merge-deep
merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that …
-
High 7.5
Regular Expression Denial of Service in content
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Dispo…
-
High 7.5
Directory Traversal in fast-http-cli
fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
mssql.js is malware
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Directory Traversal in commentapp.stetsonwood
commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in wangguojing123
wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially cr…
-
High 7.5
Directory Traversal in byucslabsix
byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in zwserver
zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in tinyserver2
tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in sencisho
Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in caolilinode
caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in lab6drewfusbyu
lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in cuciuci
cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in fbr-client
fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in dylmomo
dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in dgard8.lab6
dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.