{"items":[{"id":"CVE-2017-0938","published":"2019-02-12T22:00:00.000Z","updated":"2024-09-16T18:49:35.479Z","title":"Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"airMAX, EdgeMAX","kev":false,"epss":0.20974,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16493","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.903Z","title":"A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"static-resource-server","kev":false,"epss":0.01764,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16492","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.840Z","title":"A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"extend","kev":false,"epss":0.0305,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16491","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.711Z","title":"A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"node.extend","kev":false,"epss":0.01719,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16490","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.842Z","title":"A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mpath","kev":false,"epss":0.01101,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16489","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.562Z","title":"A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"just-extend","kev":false,"epss":0.01836,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16487","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.702Z","title":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying…","severity":"MEDIUM","score":5.6,"vendor":"HackerOne","product":"lodash","kev":false,"epss":0.01491,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16486","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.798Z","title":"A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"defaults-deep","kev":false,"epss":0.01481,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16485","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.559Z","title":"Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"m-server","kev":false,"epss":0.01333,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16484","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.703Z","title":"A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special…","severity":"MEDIUM","score":5.4,"vendor":"HackerOne","product":"m-server","kev":false,"epss":0.00606,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16483","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.838Z","title":"A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"express-cart","kev":false,"epss":0.01156,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16482","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.435Z","title":"A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mcstatic","kev":false,"epss":0.01821,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16481","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.672Z","title":"A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"html-pages","kev":false,"epss":0.00691,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16480","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.712Z","title":"A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"public","kev":false,"epss":0.00769,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16479","published":"2019-02-01T18:00:00.000Z","updated":"2024-08-05T10:24:32.597Z","title":"Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"http-live-simulator","kev":false,"epss":0.0165,"kevAdded":null,"exploit":false},{"id":"CVE-2018-16469","published":"2018-10-30T21:00:00.000Z","updated":"2024-08-05T10:24:32.373Z","title":"The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"merge","kev":false,"epss":0.01678,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3787","published":"2018-08-31T16:00:00.000Z","updated":"2024-09-16T18:03:37.666Z","title":"Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"simplehttpserver","kev":false,"epss":0.02038,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3776","published":"2018-08-12T22:00:00.000Z","updated":"2024-08-05T04:50:30.811Z","title":"Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"Nextcloud Server","kev":false,"epss":0.01263,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3775","published":"2018-08-12T22:00:00.000Z","updated":"2024-08-05T04:50:30.743Z","title":"Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"Nextcloud Server","kev":false,"epss":0.01234,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3774","published":"2018-08-12T22:00:00.000Z","updated":"2024-08-05T04:50:30.463Z","title":"Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication…","severity":"CRITICAL","score":10,"vendor":"HackerOne","product":"url-parse","kev":false,"epss":0.03805,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3779","published":"2018-08-10T21:00:00.000Z","updated":"2024-08-05T04:50:30.831Z","title":"active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"active-support ruby gem","kev":false,"epss":0.06477,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3778","published":"2018-08-08T20:00:00.000Z","updated":"2024-09-16T18:18:21.081Z","title":"Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"aedes","kev":false,"epss":0.01417,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3771","published":"2018-07-20T22:00:00.000Z","updated":"2024-09-16T17:03:15.839Z","title":"An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"statics-server","kev":false,"epss":0.0093,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3770","published":"2018-07-20T22:00:00.000Z","updated":"2024-09-16T16:42:35.385Z","title":"A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.","severity":"MEDIUM","score":5.5,"vendor":"HackerOne","product":"markdown-pdf","kev":false,"epss":0.00501,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3760","published":"2018-06-26T19:00:00.000Z","updated":"2024-09-16T18:39:20.968Z","title":"There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"Sprockets","kev":false,"epss":0.26346,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3759","published":"2018-06-13T15:00:00.000Z","updated":"2024-09-16T20:26:38.707Z","title":"private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being…","severity":"LOW","score":3.7,"vendor":"HackerOne","product":"private_address_check ruby gem","kev":false,"epss":0.0068,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3758","published":"2018-06-07T21:00:00.000Z","updated":"2024-09-17T02:11:59.627Z","title":"Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"express-cart","kev":false,"epss":0.27071,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3739","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:25:44.584Z","title":"https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in…","severity":"CRITICAL","score":9.1,"vendor":"HackerOne","product":"https-proxy-agent node module","kev":false,"epss":0.01735,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3738","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:46:56.890Z","title":"protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.","severity":"MEDIUM","score":5.5,"vendor":"HackerOne","product":"protobufjs node module","kev":false,"epss":0.00943,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3737","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:42:53.453Z","title":"sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sshpk node module","kev":false,"epss":0.01711,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3735","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:14:25.981Z","title":"bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"bracket-template node module","kev":false,"epss":0.00814,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3732","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:11:35.184Z","title":"resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"resolve-path node module","kev":false,"epss":0.02373,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3731","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:23:52.400Z","title":"public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"public node module","kev":false,"epss":0.02007,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3730","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:56:12.788Z","title":"mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mcstatic node module","kev":false,"epss":0.02007,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3729","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:45:17.550Z","title":"localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"localhost-now node module","kev":false,"epss":0.0199,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3727","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:08:20.341Z","title":"626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"626 node module","kev":false,"epss":0.02007,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3726","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:05:37.055Z","title":"crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"crud-file-server node module","kev":false,"epss":0.01061,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3725","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T21:57:42.628Z","title":"hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hekto node module","kev":false,"epss":0.02007,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3724","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:15:34.641Z","title":"general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"general-file-server node module","kev":false,"epss":0.01736,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3723","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T21:08:12.039Z","title":"defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"defaults-deep node module","kev":false,"epss":0.02004,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3722","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:14:35.263Z","title":"merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"merge-deep node module","kev":false,"epss":0.02004,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3721","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:34:54.590Z","title":"lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions,…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"lodash node module","kev":false,"epss":0.02347,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3720","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:56:52.100Z","title":"assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"assign-deep node module","kev":false,"epss":0.01988,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3719","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:19:14.237Z","title":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"mixin-deep node module","kev":false,"epss":0.0209,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3718","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:36:21.693Z","title":"serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"serve node module","kev":false,"epss":0.01295,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3717","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:52:59.797Z","title":"connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.","severity":"MEDIUM","score":5.4,"vendor":"HackerOne","product":"connect node module","kev":false,"epss":0.01306,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3716","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:53:14.084Z","title":"simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.","severity":"MEDIUM","score":5.4,"vendor":"HackerOne","product":"simplehttpserver node module","kev":false,"epss":0.00633,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3715","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:08:49.420Z","title":"glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"glance node module","kev":false,"epss":0.01456,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3714","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:51:50.998Z","title":"node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"node-srv node module","kev":false,"epss":0.08574,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3713","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:53:09.024Z","title":"angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"angular-http-server node module","kev":false,"epss":0.01452,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3712","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:05:56.311Z","title":"serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"serve node module","kev":false,"epss":0.0179,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3711","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:24:04.599Z","title":"Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with \"Content-Type: application/json\" and a very large…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fastify node module","kev":false,"epss":0.01771,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16226","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:38:08.513Z","title":"The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"static-eval node module node module","kev":false,"epss":0.03541,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16225","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:52:51.508Z","title":"aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"aegir node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16224","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:47:48.660Z","title":"st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"st node module","kev":false,"epss":0.00866,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16223","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:20:48.902Z","title":"nodeaaaaa is a static file server. nodeaaaaa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodeaaaaa node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16222","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:44:17.687Z","title":"elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing \"../\" in the url.…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"elding node module","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16221","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:36:50.872Z","title":"yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"yzt node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16220","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:25:37.389Z","title":"wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"wind-mvc node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16219","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:07:55.684Z","title":"yttivy is a static file server. yttivy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"yttivy node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16218","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:15:24.231Z","title":"dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"dgard8.lab6 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16217","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:27:24.116Z","title":"fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fbr-client node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16216","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:03:58.203Z","title":"tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"tencent-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16215","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:56:40.152Z","title":"sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sgqserve node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16214","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:52:21.790Z","title":"peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"peiserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16213","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:03:32.402Z","title":"mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mfrserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16212","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:26:41.368Z","title":"ltt is a static file server. ltt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ltt node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16211","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:11:33.978Z","title":"lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"lessindex node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16210","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:46:18.513Z","title":"jn_jj_server is a static file server. jn_jj_server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\"…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jn_jj_server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16209","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:11:06.684Z","title":"enserver is a simple web server. enserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"enserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16208","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:42:26.974Z","title":"dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"dmmcquay.lab6 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16207","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:21:18.986Z","title":"discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.","severity":"HIGH","score":7.3,"vendor":"HackerOne","product":"discordi.js node module","kev":false,"epss":0.00738,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16205","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:52:26.083Z","title":"The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"coffeescript node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16204","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:08:16.634Z","title":"The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jquey node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16203","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:00:54.469Z","title":"The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"coffeescript node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16202","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:46:24.524Z","title":"The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"coffeescript node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16201","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:08:29.336Z","title":"zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"zjjserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16200","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:11:08.457Z","title":"uv-tj-demo is a static file server. uv-tj-demo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"uv-tj-demo node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16199","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:50:31.223Z","title":"susu-sum is a static file server. susu-sum is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"susu-sum node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16197","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:53:09.329Z","title":"qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"qinserve node module","kev":false,"epss":0.03191,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16196","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:42:07.189Z","title":"quickserver is a simple static file server. quickserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"quickserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16195","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:06:51.516Z","title":"pytservce is a static file server. pytservce is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"pytservce node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16194","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:08:25.883Z","title":"picard is a micro framework. picard is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"picard node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16193","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:38:17.625Z","title":"mfrs is a static file server. mfrs is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mfrs node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16192","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:11:46.475Z","title":"getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"getcityapi.yoehoehne node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16191","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:56:05.224Z","title":"cypserver is a static file server. cypserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"cypserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16190","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:58:53.973Z","title":"dcdcdcdcdc is a static file server. dcdcdcdcdc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"dcdcdcdcdc node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16189","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:10:25.469Z","title":"sly07 is an API for censoring text. sly07 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sly07 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16188","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:43:50.911Z","title":"reecerver is a web server. reecerver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"reecerver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16187","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:19:14.556Z","title":"open-device creates a web interface for any device. open-device is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"open-device node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16186","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:05:57.693Z","title":"360class.jansenhm is a static file server. 360class.jansenhm is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"360class.jansenhm node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16185","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:14:34.319Z","title":"uekw1511server is a static file server. uekw1511server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"uekw1511server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16184","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:42:12.049Z","title":"scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"scott-blanch-weather-app node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16182","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:58:36.683Z","title":"serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverxxx node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16181","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:48:01.989Z","title":"wintiwebdev is a static file server. wintiwebdev is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"wintiwebdev node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16180","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:21:55.984Z","title":"serverabc is a static file server. serverabc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverabc node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16179","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:46:45.582Z","title":"dasafio is a web server. dasafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url. File…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"dasafio node module","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16178","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:40:55.913Z","title":"intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"intsol-package node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16177","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:27:54.306Z","title":"chatbyvista is a file server. chatbyvista is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"chatbyvista node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16176","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:27:42.811Z","title":"jansenstuffpleasework is a file server. jansenstuffpleasework is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jansenstuffpleasework node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16175","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:21:42.413Z","title":"ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ewgaddis.lab6 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16174","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:58:02.930Z","title":"whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"whispercast node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16173","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:56:37.124Z","title":"utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving an attacker access to…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"utahcityfinder node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16172","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:25:04.576Z","title":"section2.madisonjbrooks12 is a simple web server. section2.madisonjbrooks12 is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"section2.madisonjbrooks12 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16171","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:37:48.255Z","title":"hcbserver is a static file server. hcbserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hcbserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16170","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:55:38.101Z","title":"liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"liuyaserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16169","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:33:44.847Z","title":"looppake is a simple http server. looppake is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"looppake node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16168","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:08:23.692Z","title":"wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"wffserve node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16167","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:33:43.884Z","title":"yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"yyooopack node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16166","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:42:10.339Z","title":"byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"byucslabsix node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16165","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:46:12.774Z","title":"calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"calmquist.static-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16164","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:33:48.270Z","title":"desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url,…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"desafio node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16163","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:46:51.959Z","title":"dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"dylmomo node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16162","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:43:29.798Z","title":"22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"22lixian node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16161","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:12:32.663Z","title":"shenliru is a simple file server. shenliru is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"shenliru node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16160","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:17:13.538Z","title":"11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"11xiaoli node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16159","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:53:11.640Z","title":"caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"caolilinode node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16158","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:34:58.817Z","title":"dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"dcserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16157","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:20:42.922Z","title":"censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"censorify.tanisjr node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16156","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:19:30.385Z","title":"myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"myprolyz node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16155","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:35:58.830Z","title":"fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fast-http-cli node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16154","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:17:58.169Z","title":"earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"earlybird node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16152","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:37:05.290Z","title":"static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"static-html-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16151","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:54:03.710Z","title":"Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"electron node module","kev":false,"epss":0.02675,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16150","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:59:54.740Z","title":"wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\"…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"wangguojing123 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16149","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:02:11.450Z","title":"zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"zwserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16148","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:31:50.337Z","title":"serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serve46 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16147","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:03:17.308Z","title":"shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"shit-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16146","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:17:51.868Z","title":"mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mockserve node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16145","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:16:28.479Z","title":"sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\"…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sspa node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16144","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:59:38.705Z","title":"myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"myserver.alexcthomas18 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16143","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:13:46.115Z","title":"commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"commentapp.stetsonwood node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16142","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:40:08.702Z","title":"infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"infraserver node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16141","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:24:16.908Z","title":"lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"lab6drewfusbyu node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16140","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:10:39.064Z","title":"lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"lab6.brit95 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16139","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:07:05.460Z","title":"jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url. Accessible…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jikes node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16138","published":"2018-06-07T02:00:00.000Z","updated":"2026-10-07T20:13:00.297Z","title":"The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mime node module","kev":false,"epss":0.02119,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16137","published":"2018-06-07T02:00:00.000Z","updated":"2026-10-15T15:54:18.885Z","title":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"debug node module","kev":false,"epss":0.02832,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16136","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:18:13.960Z","title":"method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it.…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"method-override node module","kev":false,"epss":0.01196,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16135","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:52:07.631Z","title":"serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverzyy node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16134","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:55:30.030Z","title":"http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"http_static_simple node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16133","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:56:43.157Z","title":"goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"goserv node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16132","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:32:42.217Z","title":"simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"simple-npm-registry node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16131","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:49:18.988Z","title":"unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"unicorn-list node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16130","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:43:42.412Z","title":"exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"exxxxxxxxxxx node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16129","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:04:07.190Z","title":"The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"superagent node module","kev":false,"epss":0.0174,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16128","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:31:18.523Z","title":"The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"npm-script-demo node module","kev":false,"epss":0.01432,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16127","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T22:51:09.864Z","title":"The module pandora-doomsday infects other modules. It's since been unpublished from the registry.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"pandora-doomsday node module","kev":false,"epss":0.01432,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16125","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:12:53.281Z","title":"rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"rtcmulticonnection-client node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16124","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:19:41.237Z","title":"node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-server-forfront node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16123","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:49:01.423Z","title":"welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"welcomyzt node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16122","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:06:39.019Z","title":"cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"cuciuci node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16121","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:15:46.516Z","title":"datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"datachannel-client node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16120","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:31:37.503Z","title":"liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"liyujing node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16119","published":"2018-06-07T02:00:00.000Z","updated":"2026-10-08T19:43:05.054Z","title":"Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fresh node module","kev":false,"epss":0.01573,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16118","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:06:51.232Z","title":"The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"forwarded node module","kev":false,"epss":0.01853,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16117","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:16:46.857Z","title":"slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"slug node module","kev":false,"epss":0.01559,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16116","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:35:06.187Z","title":"The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"string node module","kev":false,"epss":0.01634,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16115","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:12:20.165Z","title":"The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"timespan node module","kev":false,"epss":0.01479,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16114","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:44:01.567Z","title":"The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"marked node module","kev":false,"epss":0.01731,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16113","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:46:50.284Z","title":"The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"parsejson node module","kev":false,"epss":0.01485,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16111","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:37:31.202Z","title":"The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"content node module","kev":false,"epss":0.01108,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16110","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:27:30.487Z","title":"weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"weather.swlyons node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16109","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:20:42.989Z","title":"easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"easyquick node module","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16108","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:08:21.402Z","title":"gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"gaoxiaotingtingting node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16107","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:13:41.674Z","title":"pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"pooledwebsocket node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16106","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:32:01.121Z","title":"tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"tmock node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16105","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:24:33.590Z","title":"serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverwzl node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16104","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:32:16.994Z","title":"citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"citypredict.whauwiller node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16103","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:11:53.088Z","title":"serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\"…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serveryztyzt node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16102","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T23:36:51.454Z","title":"serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverhuwenhui node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16101","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:41:09.946Z","title":"serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverwg node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16100","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T02:16:17.609Z","title":"dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"dns-sync node module","kev":false,"epss":0.05053,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16099","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:56:56.438Z","title":"The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"no-case node module","kev":false,"epss":0.01559,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16098","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:03:05.636Z","title":"charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"charset node module","kev":false,"epss":0.01631,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16097","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:30:39.731Z","title":"tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"tiny-http node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16096","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:19:00.448Z","title":"serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serveryaozeyan node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16095","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:21:46.761Z","title":"serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverliujiayi1 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16094","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:49:13.137Z","title":"iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"iter-http node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16093","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:18:53.585Z","title":"cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\"…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"cyber-js node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16092","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:29:05.227Z","title":"Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sencisho node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16091","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T21:02:25.201Z","title":"xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"xtalk node module","kev":false,"epss":0.01766,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16090","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:42:07.064Z","title":"fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fsk-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16089","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:02:39.089Z","title":"serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"serverlyr node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16088","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:13:38.445Z","title":"The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard…","severity":"CRITICAL","score":10,"vendor":"HackerOne","product":"safe-eval node module","kev":false,"epss":0.03441,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16086","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:31:35.528Z","title":"ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ua-parser node module","kev":false,"epss":0.09102,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16085","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:46:49.324Z","title":"tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"tinyserver2 node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16084","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:33:15.728Z","title":"list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"list-n-stream node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16083","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:13:51.663Z","title":"node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-simple-router node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16082","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:49:23.543Z","title":"A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"pg node module","kev":false,"epss":0.1045,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16081","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:33:41.611Z","title":"cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"cross-env.js node module","kev":false,"epss":0.01266,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16080","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:59:03.922Z","title":"nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodesass node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16079","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:15:27.449Z","title":"smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"smb node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16078","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:09:09.108Z","title":"shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"shadowsock node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16077","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:53:10.528Z","title":"mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mongose node module","kev":false,"epss":0.0122,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16076","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:06:15.829Z","title":"proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"proxy.js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16075","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T20:51:39.905Z","title":"http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"http-proxy.js node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16074","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:42:04.209Z","title":"crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"crossenv node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16073","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T18:23:43.644Z","title":"noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"noderequest node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16072","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:48:12.721Z","title":"nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodemailer.js node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16071","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:25:34.845Z","title":"nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodemailer-js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16070","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:29:04.270Z","title":"nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodecaffe node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16069","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:57:46.862Z","title":"nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodeffmpeg node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16068","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T01:12:02.148Z","title":"ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ffmepg node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16067","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:14:25.481Z","title":"node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-opencv node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16066","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T04:14:23.387Z","title":"opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"opencv.js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16065","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:37:05.170Z","title":"openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"openssl.js node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16064","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:19:02.079Z","title":"node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-openssl node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16063","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T17:53:48.445Z","title":"node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-opensl node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16060","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T03:48:25.761Z","title":"babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"babelcli node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16059","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:01:42.895Z","title":"mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mssql-node node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16058","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T19:14:31.734Z","title":"gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"gruntcli node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16057","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-17T00:15:50.693Z","title":"nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodemssql node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16056","published":"2018-06-07T02:00:00.000Z","updated":"2024-09-16T16:23:54.756Z","title":"mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mssql.js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16055","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:10:56.654Z","title":"`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sqlserver node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16054","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T23:36:57.788Z","title":"`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodefabric node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16053","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:14:00.858Z","title":"`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fabric-js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16052","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:05:54.584Z","title":"`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-fabric node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16051","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:36:13.920Z","title":"`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sqliter node module","kev":false,"epss":0.01266,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16050","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T23:05:46.606Z","title":"`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sqlite.js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16049","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:46:17.496Z","title":"`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"nodesqlite node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16048","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T19:00:59.500Z","title":"`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-sqlite node module","kev":false,"epss":0.01158,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16046","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T22:50:41.688Z","title":"`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mariadb node module","kev":false,"epss":0.01117,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16045","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T18:28:45.804Z","title":"`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jquery.js node module","kev":false,"epss":0.01106,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16044","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T00:21:50.833Z","title":"`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"d3.js node module","kev":false,"epss":0.01452,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16043","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T16:58:10.449Z","title":"Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"shout node module","kev":false,"epss":0.00999,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16042","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:08:21.801Z","title":"Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"growl node module","kev":false,"epss":0.04581,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16041","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:55:33.643Z","title":"ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"ikst node module","kev":false,"epss":0.00645,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16040","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T19:14:22.506Z","title":"gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"gfe-sass node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16039","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T02:47:23.736Z","title":"`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hftp node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16038","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T19:19:36.920Z","title":"`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url. This is…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"f2e-server node module","kev":false,"epss":0.02504,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16037","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T22:19:45.670Z","title":"`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"gomeplus-h5-proxy node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16036","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T02:47:21.539Z","title":"`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"badjs-sourcemap-server node module","kev":false,"epss":0.01974,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16035","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:26:31.843Z","title":"The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"hubl-server node module","kev":false,"epss":0.0072,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16031","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T21:07:25.207Z","title":"Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"socket.io node module","kev":false,"epss":0.01969,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16030","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T00:41:28.696Z","title":"Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"useragent node module","kev":false,"epss":0.01144,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16029","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T00:11:57.294Z","title":"hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hostr node module","kev":false,"epss":0.01797,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16028","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T02:06:18.622Z","title":"react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"react-native-meteor-oauth node module","kev":false,"epss":0.01329,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16026","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:28:08.484Z","title":"Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"request node module","kev":false,"epss":0.02584,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16025","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:12:03.298Z","title":"Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"nes node module","kev":false,"epss":0.01872,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16024","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:48:58.293Z","title":"The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values.…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"sync-exec node module","kev":false,"epss":0.02518,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16023","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:01:40.957Z","title":"Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"decamelize node module","kev":false,"epss":0.01433,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16022","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T21:08:55.440Z","title":"Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"Morris.js node module","kev":false,"epss":0.00891,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16021","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:46:00.192Z","title":"uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this,…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"uri-js node module","kev":false,"epss":0.01321,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16020","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T20:06:20.093Z","title":"Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"summit node module","kev":false,"epss":0.02458,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16019","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T23:35:38.065Z","title":"GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"gitbook node module","kev":false,"epss":0.00922,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16018","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:54:46.223Z","title":"Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"restify node module","kev":false,"epss":0.00951,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16017","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:40:49.487Z","title":"sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"sanitize-html node module","kev":false,"epss":0.01167,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16016","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T01:46:48.797Z","title":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"sanitize-html node module","kev":false,"epss":0.01336,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16015","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T22:56:32.290Z","title":"Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"forms node module","kev":false,"epss":0.00835,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16014","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T21:57:09.433Z","title":"Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server,…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"http-proxy node module","kev":false,"epss":0.0166,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16013","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T04:09:41.605Z","title":"hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hapi node module","kev":false,"epss":0.01559,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16009","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T02:41:23.964Z","title":"ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"ag-grid node module","kev":false,"epss":0.01029,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16008","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T17:53:16.453Z","title":"i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"i18next node module","kev":false,"epss":0.00849,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16007","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T18:23:49.490Z","title":"node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"node-jose node module","kev":false,"epss":0.00913,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16006","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T03:01:59.476Z","title":"Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"remarkable node module","kev":false,"epss":0.00962,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16005","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T19:19:33.991Z","title":"Http-signature is a \"Reference implementation of Joyent's HTTP Signature Scheme\". In versions <=0.9.11, http-signature signs only the header values, but not…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"http-signature node module","kev":false,"epss":0.00844,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0931","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T03:59:01.542Z","title":"html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"html-janitor node module","kev":false,"epss":0.01046,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0930","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T16:32:58.291Z","title":"augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"augustine node module","kev":false,"epss":0.01198,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0928","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T04:04:20.635Z","title":"html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"html-janitor node module","kev":false,"epss":0.01022,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10697","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-17T00:00:39.273Z","title":"react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP,…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"react-native-baidu-voice-synthesizer node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10696","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T22:25:11.602Z","title":"windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-latestchromedriver node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10695","published":"2018-06-04T19:00:00.000Z","updated":"2024-09-16T22:02:16.686Z","title":"The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"npm-test-sqlite3-trunk node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10694","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T23:31:20.981Z","title":"alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"alto-saxophone node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10693","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T17:48:00.321Z","title":"pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"pm2-kafka node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10691","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T21:56:59.682Z","title":"windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-seleniumjar node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10690","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:43:57.111Z","title":"openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"openframe-ascii-image node module","kev":false,"epss":0.01673,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10689","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:54:53.079Z","title":"The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-iedriver node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10688","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T01:51:52.519Z","title":"Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"haxe3 node module","kev":false,"epss":0.01673,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10687","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T23:27:04.981Z","title":"windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-selenium-chromedriver node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10686","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:38:24.495Z","title":"fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"fis-sass-all node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10685","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T20:17:01.496Z","title":"pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"pk-app-wonderbox node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10684","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T00:16:26.720Z","title":"healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"healthcenter node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10683","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T01:11:32.095Z","title":"arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"arcanist node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10678","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T22:14:54.713Z","title":"serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"serc.js node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10677","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T21:08:30.402Z","title":"google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"google-closure-tools-latest node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10676","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T01:31:56.336Z","title":"rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"rs-brightcove node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10675","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:36:56.109Z","title":"libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"libsbmlsim node module","kev":false,"epss":0.01989,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10673","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T01:16:06.952Z","title":"ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"ipip-coffee node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10672","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:34:00.636Z","title":"cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"cloudpub-redis node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10671","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T23:46:58.252Z","title":"mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"mystem-wrapper node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10670","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T20:46:43.019Z","title":"windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-seleniumjar-mirror node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10669","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T20:27:38.497Z","title":"soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"soci node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10668","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T22:45:50.113Z","title":"libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"libsbml node module","kev":false,"epss":0.01989,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10667","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T16:49:01.620Z","title":"selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-portal node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10665","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T22:20:27.726Z","title":"herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"herbivore node module","kev":false,"epss":0.02155,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10664","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T19:24:06.701Z","title":"mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"mystem node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10663","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T20:48:06.578Z","title":"wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"wixtoolset node module","kev":false,"epss":0.02177,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10662","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:11:25.036Z","title":"tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"tomita node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10661","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T16:24:14.031Z","title":"phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"phantomjs-cheniu node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10660","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:27:59.515Z","title":"fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"fis-parser-sass-bin node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10657","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:34:22.989Z","title":"co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"co-cli-installer node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10656","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:32:45.932Z","title":"qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"qbs node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10655","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T20:47:53.082Z","title":"The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"clang-extra node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10654","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T16:13:24.860Z","title":"sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"sfml node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10653","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T23:25:32.306Z","title":"xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"xd-testing node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10652","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T22:10:18.074Z","title":"prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"prebuild-lwip node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10651","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T21:08:03.603Z","title":"webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"webdriver-launcher node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10649","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T18:23:36.978Z","title":"frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"frames-compiler node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10648","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T04:14:10.920Z","title":"marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"marionette-socket-host node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10647","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T18:24:16.458Z","title":"node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"node-air-sdk node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10646","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:47:15.435Z","title":"resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"resourcehacker node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10645","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:57:06.637Z","title":"grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"grunt-images node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10644","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T00:02:06.582Z","title":"slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"slimerjs-edge node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10643","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T00:21:27.841Z","title":"jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"jstestdriver node module","kev":false,"epss":0.01672,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10642","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T00:26:32.715Z","title":"cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"cmake node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10641","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T02:26:43.954Z","title":"node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"node-bsdiff-android node module","kev":false,"epss":0.00569,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10640","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T03:02:53.433Z","title":"node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"node-thulac node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10639","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T00:56:14.613Z","title":"redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"redis-srvr node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10638","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T17:43:24.772Z","title":"js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"js-given node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10637","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-17T01:36:38.265Z","title":"haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"haxe-dev node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10636","published":"2018-06-04T16:00:00.000Z","updated":"2024-09-16T17:57:57.444Z","title":"grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"grunt-ccompiler node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10634","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T17:38:05.451Z","title":"scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"scalajs-standalone-bin node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10633","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T22:25:39.736Z","title":"dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"dwebp-bin node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10632","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T20:11:24.802Z","title":"apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"apk-parser2 node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10631","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:17:09.947Z","title":"jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"jvminstall node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10630","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T01:21:00.795Z","title":"install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"install-g-test node module","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10629","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:52:05.905Z","title":"nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"nw-with-arm node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10628","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:42:50.199Z","title":"selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-wrapper node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10626","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:17:29.653Z","title":"mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"mystem3 node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10625","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:43:06.522Z","title":"headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"headless-browser-lite node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10624","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:45:48.557Z","title":"selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP,…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-chromedriver node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10623","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:02:11.897Z","title":"macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"macaca-chromedriver-zxa node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10622","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:37:43.283Z","title":"nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"nodeschnaps node module","kev":false,"epss":0.02007,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10621","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T17:14:52.722Z","title":"fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"fibjs node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10620","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T22:09:11.870Z","title":"atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"atom-node-module-installer node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10619","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:56:48.996Z","title":"pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"pennyworth node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10618","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T18:18:18.244Z","title":"node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"node-browser node module","kev":false,"epss":0.00569,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10617","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:55:27.654Z","title":"box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"box2d-native node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10616","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:25:58.326Z","title":"openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"openframe-image node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10615","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T16:38:19.695Z","title":"curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"curses node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10614","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T02:26:59.820Z","title":"httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"httpsync node module","kev":false,"epss":0.01672,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10613","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T18:29:00.314Z","title":"bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"bionode-sra node module","kev":false,"epss":0.00514,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10612","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T02:37:40.561Z","title":"dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"dalek-browser-ie-canary node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10610","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T04:29:20.044Z","title":"unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"unicode-json node module","kev":false,"epss":0.00537,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10609","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T16:43:23.996Z","title":"chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"chromedriver126 node module","kev":false,"epss":0.01989,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10608","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:10:34.045Z","title":"robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"robot-js node module","kev":false,"epss":0.01586,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10607","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T22:40:19.234Z","title":"openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"openframe-glslviewer node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10606","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:55:44.362Z","title":"grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"grunt-webdriver-qunit node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10605","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T04:24:06.306Z","title":"dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"dalek-browser-ie node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10604","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T02:47:41.094Z","title":"dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"dalek-browser-chrome node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10603","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:23:52.030Z","title":"air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"air-sdk node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10602","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:17:58.934Z","title":"haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"haxe node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10600","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T22:20:03.139Z","title":"webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"webrtc-native node module","kev":false,"epss":0.02072,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10599","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T17:08:40.165Z","title":"sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"sauce-connect node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10598","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T19:40:03.202Z","title":"arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"arrayfire-js node module","kev":false,"epss":0.01333,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10597","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T01:01:45.608Z","title":"cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"cobalt-cli node module","kev":false,"epss":0.00522,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10596","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:40:50.717Z","title":"imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"imageoptim node module","kev":false,"epss":0.01053,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10595","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T02:06:34.048Z","title":"jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"jdf-sass node module","kev":false,"epss":0.01606,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10594","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T22:29:58.195Z","title":"ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"ipip node module","kev":false,"epss":0.00569,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10592","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T03:59:08.695Z","title":"jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"jser-stat node module","kev":false,"epss":0.00634,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10588","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T23:16:00.325Z","title":"nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"nw node module","kev":false,"epss":0.01728,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10587","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T17:13:54.056Z","title":"wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"wasdk node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10585","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T00:02:18.653Z","title":"libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"libxl node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10582","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T19:05:13.678Z","title":"closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"closurecompiler node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10581","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T18:33:59.022Z","title":"Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"steroids node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10580","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T01:21:50.851Z","title":"nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"nodewebkit node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10579","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T17:58:08.508Z","title":"Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"chromedriver node module","kev":false,"epss":0.01097,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10576","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T01:21:20.514Z","title":"Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"fuseki node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10575","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-17T02:36:12.983Z","title":"Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"kindlegen node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10574","published":"2018-06-01T18:00:00.000Z","updated":"2024-09-16T16:58:41.863Z","title":"apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"apk-parser3 node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3755","published":"2018-06-01T17:00:00.000Z","updated":"2024-08-05T04:50:30.615Z","title":"XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"sexstatic","kev":false,"epss":0.00916,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3746","published":"2018-06-01T17:00:00.000Z","updated":"2024-08-05T04:50:30.717Z","title":"The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"pdfinfojs","kev":false,"epss":0.04853,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3743","published":"2018-06-01T17:00:00.000Z","updated":"2024-08-05T04:50:30.450Z","title":"Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"hekto","kev":false,"epss":0.00917,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10572","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:33:41.577Z","title":"mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"mongodb-instance node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10571","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T18:19:33.273Z","title":"bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"bkjs-wand node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10569","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:39:03.270Z","title":"embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"embedza node module","kev":false,"epss":0.01725,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10565","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T22:15:55.926Z","title":"operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"operadriver node module","kev":false,"epss":0.01097,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10564","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:26:03.354Z","title":"apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"apk-parser node module","kev":false,"epss":0.01097,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10563","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T18:49:48.687Z","title":"During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"go-ipfs-dep node module","kev":false,"epss":0.00761,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10562","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:14:46.356Z","title":"iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"iedriver node module","kev":false,"epss":0.01656,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10561","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:24:57.968Z","title":"Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"bitty node module","kev":false,"epss":0.01473,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10560","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T00:40:36.154Z","title":"galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"galenframework-cli node module","kev":false,"epss":0.01673,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10557","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:16:19.032Z","title":"appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"appium-chromedriver node module","kev":false,"epss":0.01097,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10555","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T16:38:09.923Z","title":"Since \"algorithm\" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If…","severity":"MEDIUM","score":6.5,"vendor":"HackerOne","product":"jwt-simple node module","kev":false,"epss":0.04823,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10554","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:55:55.539Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"sequelize node module","kev":false,"epss":0.01884,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10553","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T00:16:46.372Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"sequelize node module","kev":false,"epss":0.01265,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10552","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T22:20:09.664Z","title":"igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.","severity":"HIGH","score":7.4,"vendor":"HackerOne","product":"igniteui node module","kev":false,"epss":0.00526,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10550","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T23:31:50.320Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"sequelize node module","kev":false,"epss":0.01884,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10549","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:46:02.640Z","title":"Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of…","severity":"MEDIUM","score":4.4,"vendor":"HackerOne","product":"sails node module","kev":false,"epss":0.00636,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10548","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T20:03:43.284Z","title":"Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"reduce-css-calc node module","kev":false,"epss":0.01193,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10547","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T16:43:50.537Z","title":"Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"nunjucks node module","kev":false,"epss":0.01418,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10546","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:07:44.297Z","title":"An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"pouchdb node module","kev":false,"epss":0.02565,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10544","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:56:54.139Z","title":"uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"uws node module","kev":false,"epss":0.01319,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10543","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T00:22:05.189Z","title":"call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters,…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"call node module","kev":false,"epss":0.01216,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10542","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:03:37.757Z","title":"ws is a \"simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455\". By sending an overly…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ws node module","kev":false,"epss":0.07424,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10541","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T03:18:50.154Z","title":"The npm module \"shell-quote\" 1.6.0 and earlier cannot correctly escape \">\" and \"<\" operator used for redirection in shell. Applications that depend on…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"shell-quote node module","kev":false,"epss":0.02216,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10540","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T19:24:48.196Z","title":"Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path,…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"minimatch node module","kev":false,"epss":0.01503,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10539","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:11:28.261Z","title":"negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for \"Accept-Language\",…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"negotiator node module","kev":false,"epss":0.01389,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10538","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:36:47.221Z","title":"The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any…","severity":"LOW","score":3.5,"vendor":"HackerOne","product":"cli node module","kev":false,"epss":0.00977,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10537","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:14:50.404Z","title":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through…","severity":"MEDIUM","score":5.4,"vendor":"HackerOne","product":"backbone node module","kev":false,"epss":0.00675,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10536","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:46:42.911Z","title":"engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"engine.io-client node module","kev":false,"epss":0.00997,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10535","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:30:58.704Z","title":"csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"csrf-lite node module","kev":false,"epss":0.01281,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10534","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:37:40.090Z","title":"electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"electron-packager node module","kev":false,"epss":0.00937,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10533","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T00:35:52.804Z","title":"express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"express-restify-mongoose node module","kev":false,"epss":0.014,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10532","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T22:03:05.480Z","title":"console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"console-io node module","kev":false,"epss":0.02332,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10531","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:28:55.235Z","title":"marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities,…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"marked node module","kev":false,"epss":0.0144,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10530","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:48:45.037Z","title":"The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"airbrake node module","kev":false,"epss":0.01281,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10529","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T18:33:59.616Z","title":"Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can…","severity":"HIGH","score":8.8,"vendor":"HackerOne","product":"droppy node module","kev":false,"epss":0.00485,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10528","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:30:39.884Z","title":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up…","severity":"MEDIUM","score":4.9,"vendor":"HackerOne","product":"restafary node module","kev":false,"epss":0.0118,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10527","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:16:35.976Z","title":"The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"riot-compiler node module","kev":false,"epss":0.01573,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10526","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T20:37:56.998Z","title":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In…","severity":"HIGH","score":8.6,"vendor":"HackerOne","product":"grunt-gh-pages node module","kev":false,"epss":0.01612,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10524","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:27:42.388Z","title":"i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in…","severity":"HIGH","score":8.2,"vendor":"HackerOne","product":"i18n-node-angular node module","kev":false,"epss":0.00789,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10523","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:15:35.059Z","title":"MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mqtt-packet node module","kev":false,"epss":0.0242,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10521","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T19:50:46.651Z","title":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jshamcrest node module","kev":false,"epss":0.01093,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10520","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T01:41:52.603Z","title":"jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"jadedown node module","kev":false,"epss":0.01133,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10519","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T03:02:17.484Z","title":"A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"bittorrent-dht node module","kev":false,"epss":0.01612,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10518","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T02:57:19.095Z","title":"A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ws node module","kev":false,"epss":0.01984,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9239","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T19:36:41.294Z","title":"ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ansi2html node module","kev":false,"epss":0.01133,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9238","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T17:43:37.504Z","title":"secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"secure-compare node module","kev":false,"epss":0.01477,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9236","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T04:15:13.448Z","title":"Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed…","severity":"MEDIUM","score":5.3,"vendor":"HackerOne","product":"hapi node module","kev":false,"epss":0.01516,"kevAdded":null,"exploit":false},{"id":"CVE-2014-10066","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T16:48:22.004Z","title":"Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"fancy-server node module","kev":false,"epss":0.01582,"kevAdded":null,"exploit":false},{"id":"CVE-2014-10065","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-16T22:25:48.380Z","title":"Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"remarkable node module","kev":false,"epss":0.00958,"kevAdded":null,"exploit":false},{"id":"CVE-2014-10064","published":"2018-05-31T20:00:00.000Z","updated":"2024-09-17T00:36:04.821Z","title":"The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"qs node module","kev":false,"epss":0.01377,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3745","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:59:23.153Z","title":"atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.","severity":"CRITICAL","score":9.1,"vendor":"HackerOne","product":"atob node module","kev":false,"epss":0.02127,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3744","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:55:33.316Z","title":"The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"html-pages node module","kev":false,"epss":0.02224,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3734","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:26:33.956Z","title":"stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"stattic node module","kev":false,"epss":0.01876,"kevAdded":null,"exploit":false},{"id":"CVE-2018-3733","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T01:06:57.354Z","title":"crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"crud-file-server node module","kev":false,"epss":0.02167,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16153","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T20:31:49.099Z","title":"gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing \"../\" in the url.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"gaoxuyan node module","kev":false,"epss":0.01694,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16062","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:18:57.339Z","title":"node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"node-tkinter node module","kev":false,"epss":0.01059,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16061","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T19:01:00.831Z","title":"tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"tkinter node module","kev":false,"epss":0.0109,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16047","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:51:47.555Z","title":"mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"mysqljs node module","kev":false,"epss":0.01247,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16010","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T18:38:55.446Z","title":"i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to…","severity":"MEDIUM","score":6.1,"vendor":"HackerOne","product":"i18next node module","kev":false,"epss":0.00982,"kevAdded":null,"exploit":false},{"id":"CVE-2017-16003","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:13:33.305Z","title":"windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP,…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"windows-build-tools node module","kev":false,"epss":0.02203,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10698","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:02:38.654Z","title":"mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"mystem-fix node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10682","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T01:21:46.325Z","title":"massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"massif node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10681","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:20:41.157Z","title":"roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"roslib-socketio node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10680","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:30:52.903Z","title":"adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"adamvr-geoip-lite node module","kev":false,"epss":0.00701,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10679","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:52:46.278Z","title":"selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-standalone-painful node module","kev":false,"epss":0.01952,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10674","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:46:58.844Z","title":"limbus-buildgen is a \"build anywhere\" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"limbus-buildgen node module","kev":false,"epss":0.01657,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10666","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:39:02.884Z","title":"tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"tomita-parser node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10659","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:08:05.600Z","title":"poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"poco node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10658","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:10:35.366Z","title":"native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"native-opencv node module","kev":false,"epss":0.01662,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10650","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:08:14.161Z","title":"ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"ntfserver node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10635","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T19:09:07.141Z","title":"broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"broccoli-closure node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10627","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:08:31.215Z","title":"scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"scala-bin node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10611","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T20:26:34.568Z","title":"strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"strider-sauce node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10601","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T04:18:48.609Z","title":"webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP,…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"webdrvr node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10593","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:57:06.559Z","title":"ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"ibapi node module","kev":false,"epss":0.02256,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10591","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T20:36:34.181Z","title":"Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"prince node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10590","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:54:44.496Z","title":"cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"cue-sdk-node node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10589","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:25:55.094Z","title":"selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-binaries node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10586","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T16:38:53.614Z","title":"macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"macaca-chromedriver node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10584","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T16:53:28.723Z","title":"dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"dalek-browser-chrome-canary node module","kev":false,"epss":0.01991,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10578","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T01:11:45.242Z","title":"unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"unicode node module","kev":false,"epss":0.00558,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10577","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T20:31:37.904Z","title":"ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"ibm_db node module","kev":false,"epss":0.01494,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10573","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T18:34:31.669Z","title":"baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"baryton-saxophone node module","kev":false,"epss":0.02033,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10570","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T18:43:52.168Z","title":"pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"pngcrush-installer node module","kev":false,"epss":0.01657,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10568","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T19:35:14.748Z","title":"geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"geoip-lite-country node module","kev":false,"epss":0.00558,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10567","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:48:59.372Z","title":"product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"product-monitor node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10566","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:52:25.988Z","title":"install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"install-nw node module","kev":false,"epss":0.01625,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10559","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:18:02.860Z","title":"selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"selenium-download node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10558","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:36:42.182Z","title":"aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"aerospike node module","kev":false,"epss":0.01692,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10556","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:47:51.757Z","title":"sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"sequelize node module","kev":false,"epss":0.01297,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10551","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T16:58:50.345Z","title":"waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`,…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"waterline-sequel node module","kev":false,"epss":0.01763,"kevAdded":null,"exploit":false},{"id":"CVE-2016-10525","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T01:01:50.306Z","title":"When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"hapi-auth-jwt2 node module","kev":false,"epss":0.02439,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9244","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T16:48:28.663Z","title":"Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"mysql node module","kev":false,"epss":0.02426,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9243","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T02:27:19.677Z","title":"When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"hapi node module","kev":false,"epss":0.01003,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9242","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:12:59.354Z","title":"Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"ecstatic node module","kev":false,"epss":0.02022,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9241","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T17:03:05.145Z","title":"Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"hapi node module","kev":false,"epss":0.02063,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9240","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T22:56:15.711Z","title":"Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"keystone node module","kev":false,"epss":0.00859,"kevAdded":null,"exploit":false},{"id":"CVE-2015-9235","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-16T23:05:54.010Z","title":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"jsonwebtoken node module","kev":false,"epss":0.08367,"kevAdded":null,"exploit":false},{"id":"CVE-2014-10068","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T03:12:54.633Z","title":"The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"inert node module","kev":false,"epss":0.01891,"kevAdded":null,"exploit":false},{"id":"CVE-2014-10067","published":"2018-05-29T20:00:00.000Z","updated":"2024-09-17T00:11:12.478Z","title":"paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or…","severity":"MEDIUM","score":5.9,"vendor":"HackerOne","product":"paypal-ipn node module","kev":false,"epss":0.01129,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0909","published":"2017-11-16T22:00:00.000Z","updated":"2024-09-16T16:49:03.138Z","title":"The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"private_address_check ruby gem","kev":false,"epss":0.02032,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0903","published":"2017-10-11T18:00:00.000Z","updated":"2024-09-17T03:54:57.184Z","title":"RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"RubyGems","kev":false,"epss":0.15853,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0898","published":"2017-09-15T19:00:00.000Z","updated":"2024-09-17T01:36:46.258Z","title":"Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation…","severity":"CRITICAL","score":9.1,"vendor":"HackerOne","product":"Ruby","kev":false,"epss":0.09718,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0902","published":"2017-08-31T20:00:00.000Z","updated":"2024-09-17T00:42:39.081Z","title":"RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and…","severity":"HIGH","score":8.1,"vendor":"HackerOne","product":"RubyGems","kev":false,"epss":0.0475,"kevAdded":null,"exploit":false},{"id":"CVE-2017-0901","published":"2017-08-31T20:00:00.000Z","updated":"2024-09-16T20:22:06.483Z","title":"RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the…","severity":"HIGH","score":7.5,"vendor":"HackerOne","product":"RubyGems","kev":false,"epss":0.29442,"kevAdded":null,"exploit":true},{"id":"CVE-2017-0899","published":"2017-08-31T20:00:00.000Z","updated":"2024-09-17T02:20:54.846Z","title":"RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem…","severity":"CRITICAL","score":9.8,"vendor":"HackerOne","product":"RubyGems","kev":false,"epss":0.11102,"kevAdded":null,"exploit":false}]}