Skip to content
OpenAdvisories

Vendor

npm

28 known vulnerabilities.

Products

node-tar 5 cli 5 arborist 2 http-live-simulator 1 cordova-plugin-ionic-webview 1 cached-path-relative 1 vditor 1 knightjs 1 erxes 1 npm mosca 1 mind-elixir 1 @claviska/jquery-minicolors 1 textangular 1 @fastify/oauth2 1 npm 1 buttle 1 tianma-static 1 takeapeek 1 iziModal 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2021-32854

    textAngular text editor vulnerable to Cross-site Scripting

    textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no k…

    npm textangular textangular npm
  • Medium 6.1
    CVE-2021-32850

    jQuery MiniColors vulnerable to Cross-site Scripting

    jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.

    npm @claviska/jquery-minicolors jquery-minicolors @claviska/jquery-minicolors Debian Ubuntu npm
  • Medium 6.1
    CVE-2021-32851

    jQuery MiniColors vulnerable to Cross-site Scripting

    Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1

    npm mind-elixir mind-elixir npm
  • Medium 6.1
    CVE-2021-32853

    Erxes vulnerable to Cross-site Scripting

    Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious we…

    npm erxes erxes npm
  • Medium 6.1
    CVE-2021-32855

    vditor vulnerable to Cross-site Scripting

    Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 cont…

    npm vditor vditor npm
  • Medium 6.1
    CVE-2021-32860

    iziModal vulnerable to Cross-site Scripting

    iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arb…

    npm iziModal izimodal npm
  • Medium 4.4
    CVE-2020-15095

    Sensitive information exposure through logs in npm cli

    Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…

    npm cli npm npm Debian Ubuntu npm
  • Medium 5.3
    CVE-2018-16473

    Path Traversal in takeapeek

    A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.

    npm takeapeek takeapeek npm
  • Medium 6.1
    CVE-2018-16474

    Stored Cross-Site Scripting in tianma-static

    A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.

    npm tianma-static tianma-static npm