Hackerone
470 CVEs across 447 Hackerone products. Browse Hackerone vulnerabilities, severities, and proof-of-concept exploits.
Hackerone products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0938 | High | 7.5 | 2019-02-12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. |
CVE-2018-16493 | High | 7.5 | 2019-02-01 | A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending sla… |
CVE-2018-16492 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16491 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16490 | High | 7.5 | 2019-02-01 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16489 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions. |
CVE-2018-16487 | Medium | 5.6 | 2019-02-01 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying… |
CVE-2018-16486 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype. |
CVE-2018-16485 | Medium | 6.5 | 2019-02-01 | Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd… |
CVE-2018-16484 | Medium | 5.4 | 2019-02-01 | A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special c… |
CVE-2018-16483 | High | 8.8 | 2019-02-01 | A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators. |
CVE-2018-16482 | High | 7.5 | 2019-02-01 | A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file sy… |
CVE-2018-16481 | Medium | 6.1 | 2019-02-01 | A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitizatio… |
CVE-2018-16480 | Medium | 6.1 | 2019-02-01 | A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the fi… |
CVE-2018-16479 | High | 7.5 | 2019-02-01 | Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL. |
CVE-2018-16469 | High | 7.5 | 2018-10-30 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be p… |
CVE-2018-3787 | High | 7.5 | 2018-08-31 | Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server. |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-3775 | High | 8.8 | 2018-08-12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authenticatio… |
CVE-2018-3774 | Critical | 10.0 | 2018-08-12 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protoco… |
CVE-2018-3779 | Critical | 9.8 | 2018-08-10 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker cou… |
CVE-2018-3778 | Medium | 5.3 | 2018-08-08 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. |
CVE-2018-3771 | Medium | 6.1 | 2018-07-20 | An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser. |
CVE-2018-3770 | Medium | 5.5 | 2018-07-20 | A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files. |
CVE-2018-3760 | High | 7.5 | 2018-06-26 | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted request… |
CVE-2018-3759 | Low | 3.7 | 2018-06-13 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being c… |
CVE-2018-3758 | High | 8.8 | 2018-06-07 | Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine. |
CVE-2018-3739 | Critical | 9.1 | 2018-06-07 | https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setu… |
CVE-2018-3738 | Medium | 5.5 | 2018-06-07 | protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. |
CVE-2018-3737 | High | 7.5 | 2018-06-07 | sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. |
CVE-2018-3735 | Medium | 6.1 | 2018-06-07 | bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template |
CVE-2018-3732 | High | 7.5 | 2018-06-07 | resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which all… |
CVE-2018-3731 | High | 7.5 | 2018-06-07 | public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file… |
CVE-2018-3730 | High | 7.5 | 2018-06-07 | mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any fi… |
CVE-2018-3729 | High | 7.5 | 2018-06-07 | localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any f… |
CVE-2018-3727 | High | 7.5 | 2018-06-07 | 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with k… |
CVE-2018-3726 | Medium | 6.1 | 2018-06-07 | crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. |
CVE-2018-3725 | High | 7.5 | 2018-06-07 | hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with… |
CVE-2018-3724 | High | 7.5 | 2018-06-07 | general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read conten… |
CVE-2018-3723 | High | 8.8 | 2018-06-07 | defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the… |
CVE-2018-3722 | High | 8.8 | 2018-06-07 | merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pro… |
CVE-2018-3721 | Medium | 6.5 | 2018-06-07 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, w… |
CVE-2018-3720 | High | 8.8 | 2018-06-07 | assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pr… |
CVE-2018-3719 | High | 8.8 | 2018-06-07 | mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the pro… |
CVE-2018-3718 | Medium | 5.3 | 2018-06-07 | serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded. |
CVE-2018-3717 | Medium | 5.4 | 2018-06-07 | connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware. |
CVE-2018-3716 | Medium | 5.4 | 2018-06-07 | simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. |
CVE-2018-3715 | Medium | 6.5 | 2018-06-07 | glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to re… |
CVE-2018-3714 | Medium | 6.5 | 2018-06-07 | node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file wi… |
CVE-2018-3713 | Medium | 6.5 | 2018-06-07 | angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to rea… |
CVE-2018-3712 | Medium | 6.5 | 2018-06-07 | serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a m… |
CVE-2018-3711 | High | 7.5 | 2018-06-07 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large paylo… |
CVE-2017-16226 | Critical | 9.8 | 2018-06-07 | The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global funct… |
CVE-2017-16225 | High | 7.5 | 2018-06-07 | aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that perfo… |
CVE-2017-16224 | Medium | 6.1 | 2018-06-07 | st is a module for serving static files. An attacker is able to craft a request that results in an HTTP 301 (redirect) to an entirely different domain. A reque… |
CVE-2017-16223 | High | 7.5 | 2018-06-07 | nodeaaaaa is a static file server. nodeaaaaa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16222 | Medium | 5.3 | 2018-06-07 | elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url… |
CVE-2017-16221 | High | 7.5 | 2018-06-07 | yzt is a simple file server. yzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16220 | High | 7.5 | 2018-06-07 | wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16219 | High | 7.5 | 2018-06-07 | yttivy is a static file server. yttivy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16218 | High | 7.5 | 2018-06-07 | dgard8.lab6 is a static file server. dgard8.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16217 | High | 7.5 | 2018-06-07 | fbr-client sends files through sockets via socket.io and webRTC. fbr-client is vulnerable to a directory traversal issue, giving an attacker access to the file… |
CVE-2017-16216 | High | 7.5 | 2018-06-07 | tencent-server is a simple web server. tencent-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../… |
CVE-2017-16215 | High | 7.5 | 2018-06-07 | sgqserve is a simple file server. sgqserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16214 | High | 7.5 | 2018-06-07 | peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16213 | High | 7.5 | 2018-06-07 | mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16212 | High | 7.5 | 2018-06-07 | ltt is a static file server. ltt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16211 | High | 7.5 | 2018-06-07 | lessindex is a static file server. lessindex is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16210 | High | 7.5 | 2018-06-07 | jn_jj_server is a static file server. jn_jj_server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16209 | High | 7.5 | 2018-06-07 | enserver is a simple web server. enserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16208 | High | 7.5 | 2018-06-07 | dmmcquay.lab6 is a REST server. dmmcquay.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16207 | High | 7.3 | 2018-06-07 | discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. |
CVE-2017-16205 | High | 7.5 | 2018-06-07 | The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16204 | High | 7.5 | 2018-06-07 | The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16203 | High | 7.5 | 2018-06-07 | The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16202 | High | 7.5 | 2018-06-07 | The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
CVE-2017-16201 | High | 7.5 | 2018-06-07 | zjjserver is a static file server. zjjserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16200 | High | 7.5 | 2018-06-07 | uv-tj-demo is a static file server. uv-tj-demo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in th… |
CVE-2017-16199 | High | 7.5 | 2018-06-07 | susu-sum is a static file server. susu-sum is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16197 | High | 7.5 | 2018-06-07 | qinserve is a static file server. qinserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16196 | High | 7.5 | 2018-06-07 | quickserver is a simple static file server. quickserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16195 | High | 7.5 | 2018-06-07 | pytservce is a static file server. pytservce is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16194 | High | 7.5 | 2018-06-07 | picard is a micro framework. picard is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16193 | High | 7.5 | 2018-06-07 | mfrs is a static file server. mfrs is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16192 | High | 7.5 | 2018-06-07 | getcityapi.yoehoehne is a web server. getcityapi.yoehoehne is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing… |
CVE-2017-16191 | High | 7.5 | 2018-06-07 | cypserver is a static file server. cypserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16190 | High | 7.5 | 2018-06-07 | dcdcdcdcdc is a static file server. dcdcdcdcdc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in th… |
CVE-2017-16189 | High | 7.5 | 2018-06-07 | sly07 is an API for censoring text. sly07 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16188 | High | 7.5 | 2018-06-07 | reecerver is a web server. reecerver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16187 | High | 7.5 | 2018-06-07 | open-device creates a web interface for any device. open-device is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl… |
CVE-2017-16186 | High | 7.5 | 2018-06-07 | 360class.jansenhm is a static file server. 360class.jansenhm is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placi… |
CVE-2017-16185 | High | 7.5 | 2018-06-07 | uekw1511server is a static file server. uekw1511server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16184 | High | 7.5 | 2018-06-07 | scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker acc… |
CVE-2017-16182 | High | 7.5 | 2018-06-07 | serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16181 | High | 7.5 | 2018-06-07 | wintiwebdev is a static file server. wintiwebdev is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16180 | High | 7.5 | 2018-06-07 | serverabc is a static file server. serverabc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16179 | Medium | 5.3 | 2018-06-07 | dasafio is a web server. dasafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. File ac… |
CVE-2017-16178 | High | 7.5 | 2018-06-07 | intsol-package is a file server. intsol-package is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in t… |
CVE-2017-16177 | High | 7.5 | 2018-06-07 | chatbyvista is a file server. chatbyvista is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16176 | High | 7.5 | 2018-06-07 | jansenstuffpleasework is a file server. jansenstuffpleasework is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plac… |