Skip to content
OpenAdvisories

Vendor

HackerOne

470 known vulnerabilities.

Products

RubyGems 4 hapi node module 4 sequelize node module 4 coffeescript node module 3 serve node module 2 html-janitor node module 2 ws node module 2 Nextcloud Server 2 i18next node module 2 marked node module 2 crud-file-server node module 2 private_address_check ruby gem 2 express-cart 2 nodemailer.js node module 2 remarkable node module 2 sanitize-html node module 2 m-server 2 http-live-simulator 1 lab6drewfusbyu node module 1 install-g-test node module 1 caolilinode node module 1 ibm_db node module 1 f2e-server node module 1 webrtc-native node module 1 lodash 1 desafio node module 1 phantomjs-cheniu node module 1 sencisho node module 1 hapi-auth-jwt2 node module 1 tinyserver2 node module 1 cobalt-cli node module 1 zwserver node module 1 selenium-portal node module 1 byucslabsix node module 1 react-native-baidu-voice-synthesizer node module 1 method-override node module 1 frames-compiler node module 1 npm-script-demo node module 1 jvminstall node module 1 sync-exec node module 1
All Critical High Medium Low Exploited only Public exploit

470 results · Feed

  • Medium —
    CVE-2017-16016

    Cross-Site Scripting in sanitize-html

    Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.

    HackerOne sanitize-html node module sanitize-html npm
  • High —
    CVE-2017-16006

    XSS in Data URI in remarkable

    Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.

    HackerOne remarkable node module remarkable npm
  • Critical 9.8
    CVE-2017-16020

    Unsafe eval() in summit allows arbitrary code execution

    Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.

    HackerOne summit node module summit npm
  • High 7.5
    CVE-2017-16045

    jquery.js is malware

    `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

    HackerOne jquery.js node module jquery.js npm
  • High 7.5
    CVE-2017-16052

    node-fabric is malware

    `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

    HackerOne node-fabric node module node-fabric npm
  • High 7.5
    CVE-2017-16049

    nodesqlite is malware

    `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

    HackerOne nodesqlite node module nodesqlite npm
  • High 8.1
    CVE-2017-16040

    gfe-sass downloads Resources over HTTP

    gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker c…

    HackerOne gfe-sass node module gfe-sass npm
  • Medium 6.1
    CVE-2017-16008

    Cross-Site Scripting in i18next

    i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This af…

    HackerOne i18next node module i18next npm
  • Medium —
    CVE-2017-16050

    sqlite.js is malware

    `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

    HackerOne sqlite.js node module sqlite.js npm
  • High 7.5
    CVE-2017-16031

    Insecure randomness in socket.io

    Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access …

    HackerOne socket.io node module socket.io npm
  • Medium 6.1
    CVE-2017-16015

    Cross-Site Scripting in forms

    Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting

    HackerOne forms node module forms npm
  • Medium 6.1
    CVE-2017-16009

    XSS via Angular Expression in ag-grid

    ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.

    HackerOne ag-grid node module ag-grid npm
  • High —
    CVE-2017-16041

    ikst Downloads Resources over HTTP

    ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.

    HackerOne ikst node module ikst npm
  • Unscored —
    CVE-2017-16046

    `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by …

    HackerOne mariadb node module
  • Medium —
    CVE-2017-16022

    Cross-Site Scripting in morris.js

    Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side …

    HackerOne Morris.js node module morris.js npm
  • Medium —
    CVE-2017-16043

    HTML Injection in shout

    Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.

    HackerOne shout node module shout npm
  • Medium 6.1
    CVE-2017-16018

    Cross-Site Scripting (XSS) in restify

    Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.

    HackerOne restify node module restify npm
  • High —
    CVE-2017-16025

    Denial of Service in nes

    Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submit…

    HackerOne nes node module nes npm
  • Medium 5.9
    CVE-2017-16007

    Invalid Curve Attack in node-jose

    node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the…

    HackerOne node-jose node module node-jose npm
  • Medium 6.1
    CVE-2017-16019

    Cross-Site Scripting in gitbook

    GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code…

    HackerOne gitbook node module gitbook npm
  • High 7.5
    CVE-2017-16005

    Header Forgery in http-signature

    Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can int…

    HackerOne http-signature node module http-signature npm
  • Critical 9.8
    CVE-2017-16042

    Growl before 1.10.0 vulnerable to Command Injection

    Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

    HackerOne growl node module js-jquery growl Debian Ubuntu Azure Linux npm
  • Medium 5.3
    CVE-2017-16028

    Cryptographically Weak PRNG in randomatic

    react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

    HackerOne react-native-meteor-oauth node module randomatic npm
  • High —
    CVE-2016-10684

    Downloads Resources over HTTP in healthcenter

    healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resourc…

    HackerOne healthcenter node module healthcenter npm
  • High —
    CVE-2016-10654

    Downloads Resources over HTTP in sfml

    sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

    HackerOne sfml node module sfml npm
  • High —
    CVE-2016-10637

    Downloads Resources over HTTP in haxe-dev

    haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if…

    HackerOne haxe-dev node module haxe-dev npm
  • High 8.1
    CVE-2016-10673

    ipip-coffee downloads Resources over HTTP

    ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an …

    HackerOne ipip-coffee node module ipip-coffee npm
  • High —
    CVE-2016-10670

    Downloads Resources over HTTP in windows-seleniumjar-mirror

    windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resou…

    HackerOne windows-seleniumjar-mirror node module windows-seleniumjar-mirror Windows npm
  • High —
    CVE-2016-10671

    Downloads Resources over HTTP in mystem-wrapper

    mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an atta…

    HackerOne mystem-wrapper node module mystem-wrapper npm
  • High 8.1
    CVE-2016-10665

    herbivore downloads Resources over HTTP

    herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the reques…

    HackerOne herbivore node module herbivore npm
  • High 8.1
    CVE-2016-10664

    mystem downloads Resources over HTTP

    mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary …

    HackerOne mystem node module mystem npm
  • High 8.1
    CVE-2016-10652

    prebuild-lwip downloads Resources over HTTP

    prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

    HackerOne prebuild-lwip node module prebuild-lwip npm
  • High —
    CVE-2016-10647

    Downloads Resources over HTTP in node-air-sdk

    node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled bina…

    HackerOne node-air-sdk node module node-air-sdk npm
  • High 8.1
    CVE-2016-10686

    fis-sass-all downloads Resources over HTTP

    fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker c…

    HackerOne fis-sass-all node module fis-sass-all npm
  • High —
    CVE-2016-10678

    Downloads Resources over HTTP in serc.js

    serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy…

    HackerOne serc.js node module serc.js npm
  • High 8.1
    CVE-2016-10690

    openframe-ascii-image downloads Resources over HTTP

    openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swappi…

    HackerOne openframe-ascii-image node module openframe-ascii-image npm
  • High —
    CVE-2016-10651

    Downloads Resources over HTTP in webdriver-launcher

    webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with…

    HackerOne webdriver-launcher node module webdriver-launcher npm
  • High 8.1
    CVE-2016-10663

    wixtoolset downloads Resources over HTTP

    wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources wit…

    HackerOne wixtoolset node module wixtoolset npm
  • High —
    CVE-2016-10642

    Downloads Resources over HTTP in cmake

    cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binar…

    HackerOne cmake node module cmake npm
  • High —
    CVE-2016-10636

    Downloads Resources over HTTP in grunt-ccompiler

    grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker…

    HackerOne grunt-ccompiler node module grunt-ccompiler npm