Hackerone
Page 2 of 5 — Hackerone CVEs from a corpus of 470, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16175 | High | 7.5 | 2018-06-07 | ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16174 | High | 7.5 | 2018-06-07 | whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16173 | High | 7.5 | 2018-06-07 | utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving an attacker access to… |
CVE-2017-16172 | High | 7.5 | 2018-06-07 | section2.madisonjbrooks12 is a simple web server. section2.madisonjbrooks12 is vulnerable to a directory traversal issue, giving an attacker access to the file… |
CVE-2017-16171 | High | 7.5 | 2018-06-07 | hcbserver is a static file server. hcbserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16170 | High | 7.5 | 2018-06-07 | liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16169 | High | 7.5 | 2018-06-07 | looppake is a simple http server. looppake is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16168 | High | 7.5 | 2018-06-07 | wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16167 | High | 7.5 | 2018-06-07 | yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16166 | High | 7.5 | 2018-06-07 | byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16165 | High | 7.5 | 2018-06-07 | calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue, giving an attacker access to the filesys… |
CVE-2017-16164 | High | 7.5 | 2018-06-07 | desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url… |
CVE-2017-16163 | High | 7.5 | 2018-06-07 | dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16162 | High | 7.5 | 2018-06-07 | 22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16161 | High | 7.5 | 2018-06-07 | shenliru is a simple file server. shenliru is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16160 | High | 7.5 | 2018-06-07 | 11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16159 | High | 7.5 | 2018-06-07 | caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16158 | High | 7.5 | 2018-06-07 | dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16157 | High | 7.5 | 2018-06-07 | censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to… |
CVE-2017-16156 | High | 7.5 | 2018-06-07 | myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16155 | High | 7.5 | 2018-06-07 | fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker… |
CVE-2017-16154 | High | 7.5 | 2018-06-07 | earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by… |
CVE-2017-16152 | High | 7.5 | 2018-06-07 | static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pla… |
CVE-2017-16151 | Critical | 9.8 | 2018-06-07 | Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions o… |
CVE-2017-16150 | High | 7.5 | 2018-06-07 | wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../"… |
CVE-2017-16149 | High | 7.5 | 2018-06-07 | zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16148 | High | 7.5 | 2018-06-07 | serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16147 | High | 7.5 | 2018-06-07 | shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16146 | High | 7.5 | 2018-06-07 | mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16145 | High | 7.5 | 2018-06-07 | sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../"… |
CVE-2017-16144 | High | 7.5 | 2018-06-07 | myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl… |
CVE-2017-16143 | High | 7.5 | 2018-06-07 | commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p… |
CVE-2017-16142 | High | 7.5 | 2018-06-07 | infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16141 | High | 7.5 | 2018-06-07 | lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16140 | High | 7.5 | 2018-06-07 | lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16139 | High | 7.5 | 2018-06-07 | jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible… |
CVE-2017-16138 | High | 7.5 | 2018-06-07 | The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. |
CVE-2017-16137 | Medium | 5.3 | 2018-06-07 | The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters… |
CVE-2017-16136 | High | 7.5 | 2018-06-07 | method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. met… |
CVE-2017-16135 | High | 7.5 | 2018-06-07 | serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16134 | High | 7.5 | 2018-06-07 | http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16133 | High | 7.5 | 2018-06-07 | goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16132 | High | 7.5 | 2018-06-07 | simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem… |
CVE-2017-16131 | High | 7.5 | 2018-06-07 | unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16130 | High | 7.5 | 2018-06-07 | exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the fil… |
CVE-2017-16129 | Medium | 5.9 | 2018-06-07 | The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes seve… |
CVE-2017-16128 | Critical | 9.8 | 2018-06-07 | The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
CVE-2017-16127 | Critical | 9.8 | 2018-06-07 | The module pandora-doomsday infects other modules. It's since been unpublished from the registry. |
CVE-2017-16125 | High | 7.5 | 2018-06-07 | rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a direct… |
CVE-2017-16124 | High | 7.5 | 2018-06-07 | node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesy… |
CVE-2017-16123 | High | 7.5 | 2018-06-07 | welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16122 | High | 7.5 | 2018-06-07 | cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16121 | High | 7.5 | 2018-06-07 | datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access… |
CVE-2017-16120 | High | 7.5 | 2018-06-07 | liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16119 | High | 7.5 | 2018-06-07 | Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is p… |
CVE-2017-16118 | High | 7.5 | 2018-06-07 | The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when… |
CVE-2017-16117 | High | 7.5 | 2018-06-07 | slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted in… |
CVE-2017-16116 | High | 7.5 | 2018-06-07 | The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically… |
CVE-2017-16115 | High | 7.5 | 2018-06-07 | The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around… |
CVE-2017-16114 | High | 7.5 | 2018-06-07 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for… |
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2017-16111 | High | 7.5 | 2018-06-07 | The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to r… |
CVE-2017-16110 | High | 7.5 | 2018-06-07 | weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the file… |
CVE-2017-16109 | Medium | 5.3 | 2018-06-07 | easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the u… |
CVE-2017-16108 | High | 7.5 | 2018-06-07 | gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing… |
CVE-2017-16107 | High | 7.5 | 2018-06-07 | pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16106 | High | 7.5 | 2018-06-07 | tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16105 | High | 7.5 | 2018-06-07 | serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16104 | High | 7.5 | 2018-06-07 | citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16103 | High | 7.5 | 2018-06-07 | serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16102 | High | 7.5 | 2018-06-07 | serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16101 | High | 7.5 | 2018-06-07 | serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the UR… |
CVE-2017-16100 | Critical | 9.8 | 2018-06-07 | dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible. |
CVE-2017-16099 | High | 7.5 | 2018-06-07 | The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loo… |
CVE-2017-16098 | High | 7.5 | 2018-06-07 | charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds… |
CVE-2017-16097 | High | 7.5 | 2018-06-07 | tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16096 | High | 7.5 | 2018-06-07 | serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16095 | High | 7.5 | 2018-06-07 | serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16094 | High | 7.5 | 2018-06-07 | iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16093 | High | 7.5 | 2018-06-07 | cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16092 | High | 7.5 | 2018-06-07 | Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p… |
CVE-2017-16091 | High | 7.5 | 2018-06-07 | xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem… |
CVE-2017-16090 | High | 7.5 | 2018-06-07 | fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in th… |
CVE-2017-16089 | High | 7.5 | 2018-06-07 | serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16088 | Critical | 10.0 | 2018-06-07 | The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard… |
CVE-2017-16086 | High | 7.5 | 2018-06-07 | ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a speciall… |
CVE-2017-16085 | High | 7.5 | 2018-06-07 | tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16084 | High | 7.5 | 2018-06-07 | list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving… |
CVE-2017-16083 | High | 7.5 | 2018-06-07 | node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesys… |
CVE-2017-16082 | Critical | 9.8 | 2018-06-07 | A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 l… |
CVE-2017-16081 | High | 7.5 | 2018-06-07 | cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16080 | High | 7.5 | 2018-06-07 | nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16079 | High | 7.5 | 2018-06-07 | smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16078 | High | 7.5 | 2018-06-07 | shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16077 | High | 7.5 | 2018-06-07 | mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16076 | High | 7.5 | 2018-06-07 | proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16075 | High | 7.5 | 2018-06-07 | http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16074 | High | 7.5 | 2018-06-07 | crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16073 | High | 7.5 | 2018-06-07 | noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16072 | High | 7.5 | 2018-06-07 | nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |