HackerOne
Page 3 of 5 — HackerOne CVEs from a corpus of 470, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16071 | High | 7.5 | 2018-06-07 | nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16070 | High | 7.5 | 2018-06-07 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16069 | High | 7.5 | 2018-06-07 | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16068 | High | 7.5 | 2018-06-07 | ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16067 | High | 7.5 | 2018-06-07 | node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16066 | High | 7.5 | 2018-06-07 | opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16065 | High | 7.5 | 2018-06-07 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16064 | High | 7.5 | 2018-06-07 | node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16063 | High | 7.5 | 2018-06-07 | node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16060 | High | 7.5 | 2018-06-07 | babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16059 | High | 7.5 | 2018-06-07 | mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16058 | High | 7.5 | 2018-06-07 | gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16057 | High | 7.5 | 2018-06-07 | nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16056 | High | 7.5 | 2018-06-07 | mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16055 | High | 7.5 | 2018-06-04 | `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16054 | High | 7.5 | 2018-06-04 | `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16053 | High | 7.5 | 2018-06-04 | `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16052 | High | 7.5 | 2018-06-04 | `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16051 | High | 7.5 | 2018-06-04 | `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16050 | High | 7.5 | 2018-06-04 | `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16049 | High | 7.5 | 2018-06-04 | `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16048 | High | 7.5 | 2018-06-04 | `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16046 | High | 7.5 | 2018-06-04 | `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16045 | High | 7.5 | 2018-06-04 | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16044 | High | 7.5 | 2018-06-04 | `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-16042 | Critical | 9.8 | 2018-06-04 | Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command… |
CVE-2017-16041 | Medium | 5.9 | 2018-06-04 | ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2017-16040 | High | 8.1 | 2018-06-04 | gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2017-16039 | High | 7.5 | 2018-06-04 | `hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16038 | High | 7.5 | 2018-06-04 | `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is… |
CVE-2017-16037 | High | 7.5 | 2018-06-04 | `gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL. |
CVE-2017-16036 | High | 7.5 | 2018-06-04 | `badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker ac… |
CVE-2017-16035 | High | 8.1 | 2018-06-04 | The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It ap… |
CVE-2017-16031 | High | 7.5 | 2018-06-04 | Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to cre… |
CVE-2017-16030 | High | 7.5 | 2018-06-04 | Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arb… |
CVE-2017-16029 | High | 7.5 | 2018-06-04 | hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that… |
CVE-2017-16028 | Medium | 5.3 | 2018-06-04 | react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically s… |
CVE-2017-16026 | Medium | 5.9 | 2018-06-04 | Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is pas… |
CVE-2017-16025 | Medium | 5.9 | 2018-06-04 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an… |
CVE-2017-16024 | Medium | 6.5 | 2018-06-04 | The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. O… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16022 | Medium | 6.1 | 2018-06-04 | Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If… |
CVE-2017-16021 | Medium | 6.5 | 2018-06-04 | uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-j… |
CVE-2017-16020 | Critical | 9.8 | 2018-06-04 | Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the co… |
CVE-2017-16019 | Medium | 6.1 | 2018-06-04 | GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS… |
CVE-2017-16018 | Medium | 6.1 | 2018-06-04 | Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run i… |
CVE-2017-16017 | Medium | 6.1 | 2018-06-04 | sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability. |
CVE-2017-16016 | Medium | 6.1 | 2018-06-04 | Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scen… |
CVE-2017-16015 | Medium | 6.1 | 2018-06-04 | Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize… |
CVE-2017-16014 | High | 7.5 | 2018-06-04 | Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causin… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |
CVE-2017-16009 | Medium | 6.1 | 2018-06-04 | ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in… |
CVE-2017-16008 | Medium | 6.1 | 2018-06-04 | i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted… |
CVE-2017-16007 | Medium | 5.9 | 2018-06-04 | node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier… |
CVE-2017-16006 | Medium | 6.1 | 2018-06-04 | Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript. |
CVE-2017-16005 | High | 7.5 | 2018-06-04 | Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not th… |
CVE-2017-0931 | Medium | 6.1 | 2018-06-04 | html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values. |
CVE-2017-0930 | Medium | 6.5 | 2018-06-04 | augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file w… |
CVE-2017-0928 | Medium | 6.1 | 2018-06-04 | html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitizati… |
CVE-2016-10697 | High | 8.1 | 2018-06-04 | react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP… |
CVE-2016-10696 | High | 8.1 | 2018-06-04 | windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10695 | High | 8.1 | 2018-06-04 | The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leav… |
CVE-2016-10694 | High | 8.1 | 2018-06-04 | alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HT… |
CVE-2016-10693 | High | 8.1 | 2018-06-04 | pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10691 | High | 8.1 | 2018-06-04 | windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10690 | High | 8.1 | 2018-06-04 | openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which lea… |
CVE-2016-10689 | High | 8.1 | 2018-06-04 | The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10688 | High | 8.1 | 2018-06-04 | Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10687 | High | 8.1 | 2018-06-04 | windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leave… |
CVE-2016-10686 | High | 8.1 | 2018-06-04 | fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10685 | High | 8.1 | 2018-06-04 | pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10684 | High | 8.1 | 2018-06-04 | healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10683 | High | 8.1 | 2018-06-04 | arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the… |
CVE-2016-10678 | High | 8.1 | 2018-06-04 | serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause… |
CVE-2016-10677 | High | 8.1 | 2018-06-04 | google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads bi… |
CVE-2016-10676 | High | 8.1 | 2018-06-04 | rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10675 | High | 8.1 | 2018-06-04 | libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10673 | High | 8.1 | 2018-06-04 | ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This cou… |
CVE-2016-10672 | High | 8.1 | 2018-06-04 | cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10671 | High | 8.1 | 2018-06-04 | mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may b… |
CVE-2016-10670 | High | 8.1 | 2018-06-04 | windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM… |
CVE-2016-10669 | High | 8.1 | 2018-06-04 | soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out… |
CVE-2016-10668 | High | 8.1 | 2018-06-04 | libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10667 | High | 8.1 | 2018-06-04 | selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10665 | High | 8.1 | 2018-06-04 | herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10664 | High | 8.1 | 2018-06-04 | mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10663 | High | 8.1 | 2018-06-04 | wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10662 | High | 8.1 | 2018-06-04 | tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10661 | High | 8.1 | 2018-06-04 | phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10660 | High | 8.1 | 2018-06-04 | fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10657 | High | 8.1 | 2018-06-04 | co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10656 | High | 8.1 | 2018-06-04 | qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which le… |
CVE-2016-10655 | High | 8.1 | 2018-06-04 | The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10654 | High | 8.1 | 2018-06-04 | sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10653 | High | 8.1 | 2018-06-04 | xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10652 | High | 8.1 | 2018-06-04 | prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it v… |
CVE-2016-10651 | High | 8.1 | 2018-06-04 | webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attack… |
CVE-2016-10649 | High | 8.1 | 2018-06-04 | frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by sw… |
CVE-2016-10648 | High | 8.1 | 2018-06-04 | marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which lea… |