Vendor
HackerOne
470 known vulnerabilities.
Products
470 results · Feed
-
High 7.5
nodemailer-js is malware
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Directory Traversal in scott-blanch-weather-app
scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in static-eval
The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution.
-
High 7.5
Regular Expression Denial of Service in timespan
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
-
High 7.5
Directory Traversal in getcityapi.yoehoehne
getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium 5.9
superagent vulnerable to zip bomb attacks
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such…
-
High 7.5
Directory Traversal in susu-sum
susu-sum is a static file server. susu-sum is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in open-device
open-device creates a web interface for any device. open-device is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
node-opensl is malware
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
coffescript is malware
The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
Directory Traversal in goserv
goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in serverabc
serverabc is a static file server. serverabc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Critical 9.8
Chromium Remote Code Execution in electron
Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless …
-
High 7.5
Directory Traversal in serve46
serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in dcserver
dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in yttivy
yttivy is a static file server. yttivy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in tmock
tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in serveryaozeyan
serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
openssl.js is malware
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Directory Traversal in intsol-package
intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in reecerver
reecerver is a web server. reecerver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in dmmcquay.lab6
dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in mfrserver
mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in http_static_simple
http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in node-simple-router
node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in serverwg
serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in 11xiaoli
11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in citypredict.whauwiller
citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in simple-npm-registry
simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in sly07
sly07 is an API for censoring text. sly07 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Github Token Leak in aegir
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
-
High 7.5
Directory Traversal in tencent-server
tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in hcbserver
hcbserver is a static file server. hcbserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in weather.swlyons
weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in tiny-http
tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
http-proxy.js is malware
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Regular Expression Denial of Service in string package
The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.
-
Critical 10.0CVE-2017-16088 Public exploit
Sandbox Breakout in safe-eval
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
-
High 7.5
Directory Traversal in pytservce
pytservce is a static file server. pytservce is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in liyujing
liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.