2017 CVEs (page 21)
Page 21 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16125 | High | 7.5 | 2018-06-07 | rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a direct… |
CVE-2017-16124 | High | 7.5 | 2018-06-07 | node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesy… |
CVE-2017-16123 | High | 7.5 | 2018-06-07 | welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16122 | High | 7.5 | 2018-06-07 | cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16121 | High | 7.5 | 2018-06-07 | datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access… |
CVE-2017-16120 | High | 7.5 | 2018-06-07 | liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the ur… |
CVE-2017-16119 | High | 7.5 | 2018-06-07 | Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is p… |
CVE-2017-16118 | High | 7.5 | 2018-06-07 | The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when… |
CVE-2017-16117 | High | 7.5 | 2018-06-07 | slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted in… |
CVE-2017-16116 | High | 7.5 | 2018-06-07 | The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically… |
CVE-2017-16115 | High | 7.5 | 2018-06-07 | The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around… |
CVE-2017-16114 | High | 7.5 | 2018-06-07 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for… |
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2017-16111 | High | 7.5 | 2018-06-07 | The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to r… |
CVE-2017-16110 | High | 7.5 | 2018-06-07 | weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the file… |
CVE-2017-16109 | Medium | 5.3 | 2018-06-07 | easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the u… |
CVE-2017-16108 | High | 7.5 | 2018-06-07 | gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing… |
CVE-2017-16107 | High | 7.5 | 2018-06-07 | pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16106 | High | 7.5 | 2018-06-07 | tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16105 | High | 7.5 | 2018-06-07 | serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16104 | High | 7.5 | 2018-06-07 | citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16103 | High | 7.5 | 2018-06-07 | serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16102 | High | 7.5 | 2018-06-07 | serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16101 | High | 7.5 | 2018-06-07 | serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the UR… |
CVE-2017-16100 | Critical | 9.8 | 2018-06-07 | dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible. |
CVE-2017-16099 | High | 7.5 | 2018-06-07 | The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loo… |
CVE-2017-16098 | High | 7.5 | 2018-06-07 | charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds… |
CVE-2017-16097 | High | 7.5 | 2018-06-07 | tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16096 | High | 7.5 | 2018-06-07 | serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16095 | High | 7.5 | 2018-06-07 | serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16094 | High | 7.5 | 2018-06-07 | iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in… |
CVE-2017-16093 | High | 7.5 | 2018-06-07 | cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" i… |
CVE-2017-16092 | High | 7.5 | 2018-06-07 | Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p… |
CVE-2017-16091 | High | 7.5 | 2018-06-07 | xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem… |
CVE-2017-16090 | High | 7.5 | 2018-06-07 | fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in th… |
CVE-2017-16089 | High | 7.5 | 2018-06-07 | serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16088 | Critical | 10.0 | 2018-06-07 | The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard… |
CVE-2017-16086 | High | 7.5 | 2018-06-07 | ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a speciall… |
CVE-2017-16085 | High | 7.5 | 2018-06-07 | tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "… |
CVE-2017-16084 | High | 7.5 | 2018-06-07 | list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving… |
CVE-2017-16083 | High | 7.5 | 2018-06-07 | node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesys… |
CVE-2017-16082 | Critical | 9.8 | 2018-06-07 | A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 l… |
CVE-2017-16081 | High | 7.5 | 2018-06-07 | cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16080 | High | 7.5 | 2018-06-07 | nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16079 | High | 7.5 | 2018-06-07 | smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16078 | High | 7.5 | 2018-06-07 | shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16077 | High | 7.5 | 2018-06-07 | mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16076 | High | 7.5 | 2018-06-07 | proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16075 | High | 7.5 | 2018-06-07 | http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16074 | High | 7.5 | 2018-06-07 | crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16073 | High | 7.5 | 2018-06-07 | noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16072 | High | 7.5 | 2018-06-07 | nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16071 | High | 7.5 | 2018-06-07 | nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16070 | High | 7.5 | 2018-06-07 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16069 | High | 7.5 | 2018-06-07 | nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16068 | High | 7.5 | 2018-06-07 | ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16067 | High | 7.5 | 2018-06-07 | node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16066 | High | 7.5 | 2018-06-07 | opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16065 | High | 7.5 | 2018-06-07 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16064 | High | 7.5 | 2018-06-07 | node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16063 | High | 7.5 | 2018-06-07 | node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16060 | High | 7.5 | 2018-06-07 | babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16059 | High | 7.5 | 2018-06-07 | mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16058 | High | 7.5 | 2018-06-07 | gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16057 | High | 7.5 | 2018-06-07 | nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16056 | High | 7.5 | 2018-06-07 | mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-18154 | High | 7.8 | 2018-06-06 | A crafted binder request can cause an arbitrary unmap in MediaServer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using… |
CVE-2017-7933 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an attacker to gain unauthorized access. |
CVE-2017-7931 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access the configuratio… |
CVE-2017-7906 | High | 8.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authenticated user, which may allow an attack… |
CVE-2017-1480 | Medium | 4.3 | 2018-06-06 | IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read… |
CVE-2017-1476 | Medium | 5.9 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, ca… |
CVE-2017-1474 | Medium | 5.3 | 2018-06-06 | IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The inform… |
CVE-2017-7639 | Medium | 5.3 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of… |
CVE-2017-7637 | Critical | 9.8 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges. |
CVE-2017-7636 | Medium | 6.1 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or H… |
CVE-2017-7635 | High | 8.8 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections. |
CVE-2017-7654 | High | 7.5 | 2018-06-05 | In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT pa… |
CVE-2017-7653 | Medium | 5.3 | 2018-06-05 | The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject… |
CVE-2017-1350 | High | 8.4 | 2018-06-05 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administrator due to improper access controls. I… |
CVE-2017-18286 | Medium | 5.4 | 2018-06-05 | nZEDb v0.7.3.3 has XSS in the 404 error page. |
CVE-2017-12092 | Low | 3.7 | 2018-06-04 | An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially cr… |
CVE-2017-16055 | High | 7.5 | 2018-06-04 | `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16054 | High | 7.5 | 2018-06-04 | `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16053 | High | 7.5 | 2018-06-04 | `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16052 | High | 7.5 | 2018-06-04 | `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16051 | High | 7.5 | 2018-06-04 | `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16050 | High | 7.5 | 2018-06-04 | `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16049 | High | 7.5 | 2018-06-04 | `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16048 | High | 7.5 | 2018-06-04 | `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16046 | High | 7.5 | 2018-06-04 | `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16045 | High | 7.5 | 2018-06-04 | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16044 | High | 7.5 | 2018-06-04 | `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-16042 | Critical | 9.8 | 2018-06-04 | Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command… |
CVE-2017-16041 | Medium | 5.9 | 2018-06-04 | ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2017-16040 | High | 8.1 | 2018-06-04 | gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2017-16039 | High | 7.5 | 2018-06-04 | `hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the… |
CVE-2017-16038 | High | 7.5 | 2018-06-04 | `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is… |
CVE-2017-16037 | High | 7.5 | 2018-06-04 | `gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL. |