Vendor
HackerOne
470 known vulnerabilities.
Products
470 results · Feed
-
High 7.5
Directory Traversal in wffserve
wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium —
Hijacked Environment Variables in proxy.js
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
nodecaffe is malware
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High 7.5
Directory Traversal in mfrs
mfrs is a static file server. mfrs is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Regular Expression Denial of Service in fresh
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of…
-
High 7.5
Regular Expression Denial of Service in no-case
The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
-
Medium —
cross-env.js is malware
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High —
Regular Expression Denial of Service in parsejson
The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.
-
High 7.5
Directory Traversal in mockserve
mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in zjjserver
zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
gruntcli is malware
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Medium —
Nodesass is malware
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
Critical 9.8
pandora-doomsday is malware
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
-
High 7.5
Directory Traversal in infraserver
infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in chatbyvista
chatbyvista is a file server. chatbyvista is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in qinserve
qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium 5.3
Directory Traversal in dasafio
dasafio is a web server. dasafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. File access is restricted to only .html files.
-
High —
Directory Traversal in node-server-forfront
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.3
discordi.js is malware
discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.
-
High 7.5
Directory Traversal in datachannel-client
datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in sspa
sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High —
Directory Traversal in gaoxiaotingtingting
gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in ewgaddis.lab6
ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in unicorn-list
unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in yyooopack
yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in wind-mvc
wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in xtalk
xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
Low 3.7
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
-
High —
Directory Traversal in liuyaserver
liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in serverwzl
serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
-
High 7.5
Directory Traversal in 22lixian
22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
Medium —
Regular Expression Denial of Service in slug
slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
-
High 7.5
coffe-script is malware
The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
-
High 7.5
Directory Traversal in wintiwebdev
wintiwebdev is a static file server. wintiwebdev is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
node-openssl is malware
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
-
High —
Directory Traversal in list-n-stream
list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in yzt
yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in lessindex
lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in censorify.tanisjr
censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
-
High 7.5
Directory Traversal in whispercast
whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.