# CVEs published 2018-06-07

237 CVEs were published on June 7, 2018: 0 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2011-0467](https://cve.now/CVE-2011-0467.md): SQL injection in SUSE studio via select parameter (CVSS 8.8, SUSE Studio Onsite)
- [CVE-2018-0149](https://cve.now/CVE-2018-0149.md): A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director S (no CVSS, Cisco Integrated Management Controller Supervisor and Cisco…)
- [CVE-2018-0329](https://cve.now/CVE-2018-0329.md): A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Service (no CVSS, Cisco Wide Area Application Services unknown)
- [CVE-2018-0332](https://cve.now/CVE-2018-0332.md): A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unauthe (no CVSS, Cisco Unified IP Phone Software unknown)
- [CVE-2018-0333](https://cve.now/CVE-2018-0333.md): A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to by (no CVSS, Cisco FireSIGHT unknown)
- [CVE-2018-0334](https://cve.now/CVE-2018-0334.md): A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility C (no CVSS, Cisco AnyConnect Secure Mobility Client unknown)
- [CVE-2018-0335](https://cve.now/CVE-2018-0335.md): A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local att (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0336](https://cve.now/CVE-2018-0336.md): A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0338](https://cve.now/CVE-2018-0338.md): A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, (no CVSS, Cisco Unified Computing System unknown)
- [CVE-2018-0339](https://cve.now/CVE-2018-0339.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (no CVSS, Cisco Identity Services Engine unknown)
- [CVE-2018-0340](https://cve.now/CVE-2018-0340.md): A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote (no CVSS, Cisco Unified Communications Manager unknown)
- [CVE-2018-0352](https://cve.now/CVE-2018-0352.md): A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated (no CVSS, Cisco Wide Area Application Services unknown)
- [CVE-2018-0354](https://cve.now/CVE-2018-0354.md): A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scrip (no CVSS, Cisco Unity Connection unknown)
- [CVE-2018-0355](https://cve.now/CVE-2018-0355.md): A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduc (no CVSS, Cisco Unified Communications Manager unknown)
- [CVE-2018-0356](https://cve.now/CVE-2018-0356.md): A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) (no CVSS, Cisco WebEx unknown)
- [CVE-2018-0357](https://cve.now/CVE-2018-0357.md): A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) (no CVSS, Cisco WebEx unknown)
- [CVE-2018-3758](https://cve.now/CVE-2018-3758.md): Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine. (no CVSS, HackerOne express-cart · express-cart)
- [CVE-2018-10619](https://cve.now/CVE-2018-10619.md): An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may (no CVSS, ICS-CERT Rockwell Automation RSLinx Classic and FactoryTalk…)
- [CVE-2018-12042](https://cve.now/CVE-2018-12042.md): Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter. (no CVSS)
- [CVE-2018-12043](https://cve.now/CVE-2018-12043.md): content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page. (no CVSS)
- [CVE-2017-6290](https://cve.now/CVE-2017-6290.md): In Android before the 2018-06-05 security patch level, NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overfl (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6292](https://cve.now/CVE-2017-6292.md): In Android before the 2018-06-05 security patch level, NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow (no CVSS, Nvidia GPU Display Driver)
- [CVE-2017-6294](https://cve.now/CVE-2017-6294.md): In Android before the 2018-06-05 security patch level, NVIDIA Tegra X1 TZ contains a possible out of bounds write due to missing bounds chec (no CVSS, Nvidia GPU Display Driver)
- [CVE-2018-12039](https://cve.now/CVE-2018-12039.md): joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a " (no CVSS)
- [CVE-2018-12036](https://cve.now/CVE-2018-12036.md): OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filena (no CVSS, org.owasp:dependency-check-maven)
- [CVE-2018-6670](https://cve.now/CVE-2018-6670.md): External Entity Attack vulnerability in McAfee Common UI (CUI) (CVSS 7.6, McAfee Common UI)
- [CVE-2018-12031](https://cve.now/CVE-2018-12031.md): Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node\_upgrade\_srv.js directory t (no CVSS)
- [CVE-2018-12016](https://cve.now/CVE-2018-12016.md): libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via cer (no CVSS)
- [CVE-2018-1514](https://cve.now/CVE-2018-1514.md): IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to ex (CVSS 4.3, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2018-1547](https://cve.now/CVE-2018-1547.md): IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused b (CVSS 8.0, IBM Robotic Process Automation with Automation Anywhere)
- [CVE-2018-12015](https://cve.now/CVE-2018-12015.md): In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite (no CVSS)
- [CVE-2018-7688](https://cve.now/CVE-2018-7688.md): Open Build Service accepts arbitrary reviews (CVSS 7.1, openSUSE Open Build Service)
- [CVE-2018-7689](https://cve.now/CVE-2018-7689.md): Open Build Service arbitrary package modification (CVSS 7.1, openSUSE Open Build Service)
- [CVE-2017-6779](https://cve.now/CVE-2017-6779.md): Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration product (no CVSS, Multiple Cisco Products unknown)
- [CVE-2018-0263](https://cve.now/CVE-2018-0263.md): A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal devic (no CVSS, Cisco Meeting Server unknown)
- [CVE-2018-0274](https://cve.now/CVE-2018-0274.md): A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbi (no CVSS, Cisco Network Services Orchestrator unknown)
- [CVE-2018-0296](https://cve.now/CVE-2018-0296.md): A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause (CVSS 7.5, KEV, Cisco Adaptive Security Appliance unknown)
- [CVE-2018-0315](https://cve.now/CVE-2018-0315.md): A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthe (no CVSS, Cisco IOS XE unknown)
- [CVE-2018-0316](https://cve.now/CVE-2018-0316.md): A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones wi (no CVSS, Cisco IP Phone 6800, 7800, and 8800 Series unknown)
- [CVE-2018-0317](https://cve.now/CVE-2018-0317.md): A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escala (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0318](https://cve.now/CVE-2018-0318.md): A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attack (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0319](https://cve.now/CVE-2018-0319.md): A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote att (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0320](https://cve.now/CVE-2018-0320.md): A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0321](https://cve.now/CVE-2018-0321.md): A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Me (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0322](https://cve.now/CVE-2018-0322.md): A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacke (no CVSS, Cisco Prime Collaboration Provisioning unknown)
- [CVE-2018-0353](https://cve.now/CVE-2018-0353.md): A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cir (no CVSS, Cisco Web Security Appliance unknown)
- [CVE-2017-16056](https://cve.now/CVE-2017-16056.md): mssql.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne mssql.js node module · mssql.js)
- [CVE-2017-16057](https://cve.now/CVE-2017-16057.md): nodemssql was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodemssql node module · nodemssql)
- [CVE-2017-16058](https://cve.now/CVE-2017-16058.md): gruntcli was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne gruntcli node module · gruntcli)
- [CVE-2017-16059](https://cve.now/CVE-2017-16059.md): mssql-node was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne mssql-node node module · mssql-node)
- [CVE-2017-16060](https://cve.now/CVE-2017-16060.md): babelcli was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne babelcli node module · babelcli)
- [CVE-2017-16063](https://cve.now/CVE-2017-16063.md): node-opensl was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-opensl node module · node-opensl)
- [CVE-2017-16064](https://cve.now/CVE-2017-16064.md): node-openssl was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-openssl node module · node-openssl)
- [CVE-2017-16065](https://cve.now/CVE-2017-16065.md): openssl.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne openssl.js node module · openssl.js)
- [CVE-2017-16066](https://cve.now/CVE-2017-16066.md): opencv.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne opencv.js node module · opencv.js)
- [CVE-2017-16067](https://cve.now/CVE-2017-16067.md): node-opencv was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne node-opencv node module · node-opencv)
- [CVE-2017-16068](https://cve.now/CVE-2017-16068.md): ffmepg was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne ffmepg node module · ffmepg)
- [CVE-2017-16069](https://cve.now/CVE-2017-16069.md): nodeffmpeg was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodeffmpeg node module · nodeffmpeg)
- [CVE-2017-16070](https://cve.now/CVE-2017-16070.md): nodecaffe was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodecaffe node module · nodecaffe)
- [CVE-2017-16071](https://cve.now/CVE-2017-16071.md): nodemailer-js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodemailer-js node module · nodemailer-js)
- [CVE-2017-16072](https://cve.now/CVE-2017-16072.md): nodemailer.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodemailer.js node module · nodemailer.js)
- [CVE-2017-16073](https://cve.now/CVE-2017-16073.md): noderequest was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne noderequest node module · noderequest)
- [CVE-2017-16074](https://cve.now/CVE-2017-16074.md): crossenv was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne crossenv node module · crossenv)
- [CVE-2017-16075](https://cve.now/CVE-2017-16075.md): http-proxy.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne http-proxy.js node module · http-proxy.js)
- [CVE-2017-16076](https://cve.now/CVE-2017-16076.md): proxy.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne proxy.js node module · proxy.js)
- [CVE-2017-16077](https://cve.now/CVE-2017-16077.md): mongose was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne mongose node module · mongose)
- [CVE-2017-16078](https://cve.now/CVE-2017-16078.md): shadowsock was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne shadowsock node module · shadowsock)
- [CVE-2017-16079](https://cve.now/CVE-2017-16079.md): smb was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne smb node module · smb)
- [CVE-2017-16080](https://cve.now/CVE-2017-16080.md): nodesass was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne nodesass node module · nodesass)
- [CVE-2017-16081](https://cve.now/CVE-2017-16081.md): cross-env.js was a malicious module published with the intent to hijack environment variables. (no CVSS, HackerOne cross-env.js node module · cross-env.js)
- [CVE-2017-16082](https://cve.now/CVE-2017-16082.md): A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column (no CVSS, HackerOne pg node module · pg)
- [CVE-2017-16083](https://cve.now/CVE-2017-16083.md): node-simple-router is a minimalistic router for Node. (no CVSS, HackerOne node-simple-router node module · node-simple-rout…)
- [CVE-2017-16084](https://cve.now/CVE-2017-16084.md): list-n-stream is a server for static files to list and stream local videos. (no CVSS, HackerOne list-n-stream node module · list-n-stream)
- [CVE-2017-16085](https://cve.now/CVE-2017-16085.md): tinyserver2 is a webserver for static files. (no CVSS, HackerOne tinyserver2 node module · tinyserver2)
- [CVE-2017-16086](https://cve.now/CVE-2017-16086.md): ua-parser is a port of Browserscope's user agent parser. (no CVSS, HackerOne ua-parser node module · ua-parser)
- [CVE-2017-16088](https://cve.now/CVE-2017-16088.md): The safe-eval module describes itself as a safer version of eval. (no CVSS, HackerOne safe-eval node module · safe-eval)
- [CVE-2017-16089](https://cve.now/CVE-2017-16089.md): serverlyr is a simple http server. (no CVSS, HackerOne serverlyr node module · serverlyr)
- [CVE-2017-16090](https://cve.now/CVE-2017-16090.md): fsk-server is a simple http server. (no CVSS, HackerOne fsk-server node module · fsk-server)
- [CVE-2017-16091](https://cve.now/CVE-2017-16091.md): xtalk helps your browser talk to nodex, a simple web framework. (no CVSS, HackerOne xtalk node module · xtalk)
- [CVE-2017-16092](https://cve.now/CVE-2017-16092.md): Sencisho is a simple http server for local development. (no CVSS, HackerOne sencisho node module · sencisho)
- [CVE-2017-16093](https://cve.now/CVE-2017-16093.md): cyber-js is a simple http server. (no CVSS, HackerOne cyber-js node module · cyber-js)
- [CVE-2017-16094](https://cve.now/CVE-2017-16094.md): iter-http is a server for static files. (no CVSS, HackerOne iter-http node module · iter-http)
- [CVE-2017-16095](https://cve.now/CVE-2017-16095.md): serverliujiayi1 is a simple http server. (no CVSS, HackerOne serverliujiayi1 node module · serverliujiayi1)
- [CVE-2017-16096](https://cve.now/CVE-2017-16096.md): serveryaozeyan is a simple HTTP server. (no CVSS, HackerOne serveryaozeyan node module · serveryaozeyan)
- [CVE-2017-16097](https://cve.now/CVE-2017-16097.md): tiny-http is a simple http server. (no CVSS, HackerOne tiny-http node module · tiny-http)
- [CVE-2017-16098](https://cve.now/CVE-2017-16098.md): charset 1.0.0 and below are vulnerable to regular expression denial of service. (no CVSS, HackerOne charset node module · charset)
- [CVE-2017-16099](https://cve.now/CVE-2017-16099.md): The no-case module is vulnerable to regular expression denial of service. (no CVSS, HackerOne no-case node module · no-case)
- [CVE-2017-16100](https://cve.now/CVE-2017-16100.md): dns-sync is a sync/blocking dns resolver. (no CVSS, HackerOne dns-sync node module · dns-sync)
- [CVE-2017-16101](https://cve.now/CVE-2017-16101.md): serverwg is a simple http server. (no CVSS, HackerOne serverwg node module · serverwg)
- [CVE-2017-16102](https://cve.now/CVE-2017-16102.md): serverhuwenhui is a simple http server. (no CVSS, HackerOne serverhuwenhui node module · serverhuwenhui)
- [CVE-2017-16103](https://cve.now/CVE-2017-16103.md): serveryztyzt is a simple http server. (no CVSS, HackerOne serveryztyzt node module · serveryztyzt)
- [CVE-2017-16104](https://cve.now/CVE-2017-16104.md): citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url (no CVSS, HackerOne citypredict.whauwiller node module · citypredict.…)
- [CVE-2017-16105](https://cve.now/CVE-2017-16105.md): serverwzl is a simple http server. (no CVSS, HackerOne serverwzl node module · serverwzl)
- [CVE-2017-16106](https://cve.now/CVE-2017-16106.md): tmock is a static file server. (no CVSS, HackerOne tmock node module · tmock)
- [CVE-2017-16107](https://cve.now/CVE-2017-16107.md): pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. (no CVSS, HackerOne pooledwebsocket node module · pooledwebsocket)
- [CVE-2017-16108](https://cve.now/CVE-2017-16108.md): gaoxiaotingtingting is an HTTP server. (no CVSS, HackerOne gaoxiaotingtingting node module · gaoxiaotingting…)
- [CVE-2017-16109](https://cve.now/CVE-2017-16109.md): easyquick is a simple web server. (no CVSS, HackerOne easyquick node module · easyquick)
- [CVE-2017-16110](https://cve.now/CVE-2017-16110.md): weather.swlyons is a simple web server for weather updates. (no CVSS, HackerOne weather.swlyons node module · weather.swlyons)
- [CVE-2017-16111](https://cve.now/CVE-2017-16111.md): The content module is a module to parse HTTP Content-\* headers. (no CVSS, HackerOne content node module · content)
- [CVE-2017-16113](https://cve.now/CVE-2017-16113.md): The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. (no CVSS, HackerOne parsejson node module · parsejson)
- [CVE-2017-16114](https://cve.now/CVE-2017-16114.md): The marked module is vulnerable to a regular expression denial of service. (no CVSS, HackerOne marked node module · marked)
- [CVE-2017-16115](https://cve.now/CVE-2017-16115.md): The timespan module is vulnerable to regular expression denial of service. (no CVSS, HackerOne timespan node module · timespan)
- [CVE-2017-16116](https://cve.now/CVE-2017-16116.md): The string module is a module that provides extra string operations. (no CVSS, HackerOne string node module · string)
- [CVE-2017-16117](https://cve.now/CVE-2017-16117.md): slug is a module to slugify strings, even if they contain unicode. (no CVSS, HackerOne slug node module · slug)
- [CVE-2017-16118](https://cve.now/CVE-2017-16118.md): The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. (no CVSS, HackerOne forwarded node module · forwarded)
- [CVE-2017-16119](https://cve.now/CVE-2017-16119.md): Fresh is a module used by the Express.js framework for HTTP response freshness testing. (CVSS 7.5, HackerOne fresh node module · fresh)
- [CVE-2017-16120](https://cve.now/CVE-2017-16120.md): liyujing is a static file server. (no CVSS, HackerOne liyujing node module · liyujing)
- [CVE-2017-16121](https://cve.now/CVE-2017-16121.md): datachannel-client is a signaling implementation for DataChannel.js. (no CVSS, HackerOne datachannel-client node module · datachannel-clie…)
- [CVE-2017-16122](https://cve.now/CVE-2017-16122.md): cuciuci is a simple fileserver. (no CVSS, HackerOne cuciuci node module · cuciuci)
- [CVE-2017-16123](https://cve.now/CVE-2017-16123.md): welcomyzt is a simple file server. (no CVSS, HackerOne welcomyzt node module · welcomyzt)
- [CVE-2017-16124](https://cve.now/CVE-2017-16124.md): node-server-forfront is a simple static file server. (no CVSS, HackerOne node-server-forfront node module · node-server-fo…)
- [CVE-2017-16125](https://cve.now/CVE-2017-16125.md): rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. (no CVSS, HackerOne rtcmulticonnection-client node module · rtcmultic…)
- [CVE-2017-16126](https://cve.now/CVE-2017-16126.md): The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. (no CVSS, botbait)
- [CVE-2017-16127](https://cve.now/CVE-2017-16127.md): The module pandora-doomsday infects other modules. (no CVSS, HackerOne pandora-doomsday node module · pandora-doomsday)
- [CVE-2017-16128](https://cve.now/CVE-2017-16128.md): The module npm-script-demo opened a connection to a command and control server. (no CVSS, HackerOne npm-script-demo node module · npm-script-demo)
- [CVE-2017-16129](https://cve.now/CVE-2017-16129.md): The HTTP client module superagent is vulnerable to ZIP bomb attacks. (no CVSS, HackerOne superagent node module · superagent)
- [CVE-2017-16130](https://cve.now/CVE-2017-16130.md): exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. (no CVSS, HackerOne exxxxxxxxxxx node module · exxxxxxxxxxx)
- [CVE-2017-16131](https://cve.now/CVE-2017-16131.md): unicorn-list is a web framework. (no CVSS, HackerOne unicorn-list node module · unicorn-list)
- [CVE-2017-16132](https://cve.now/CVE-2017-16132.md): simple-npm-registry is a local npm package cache. (no CVSS, HackerOne simple-npm-registry node module · simple-npm-regi…)
- [CVE-2017-16133](https://cve.now/CVE-2017-16133.md): goserv is an http server. (no CVSS, HackerOne goserv node module · goserv)
- [CVE-2017-16134](https://cve.now/CVE-2017-16134.md): http\_static\_simple is an http server. (no CVSS, HackerOne http\_static\_simple node module · http\_static\_simp…)
- [CVE-2017-16135](https://cve.now/CVE-2017-16135.md): serverzyy is a static file server. (no CVSS, HackerOne serverzyy node module · serverzyy)
- [CVE-2017-16136](https://cve.now/CVE-2017-16136.md): method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client does (no CVSS, HackerOne method-override node module · method-override)
- [CVE-2017-16137](https://cve.now/CVE-2017-16137.md): The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. (no CVSS, HackerOne debug node module · debug)
- [CVE-2017-16138](https://cve.now/CVE-2017-16138.md): The mime module \< 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted use (CVSS 7.5, HackerOne mime node module · mime)
- [CVE-2017-16139](https://cve.now/CVE-2017-16139.md): jikes is a file server. (no CVSS, HackerOne jikes node module · jikes)
- [CVE-2017-16140](https://cve.now/CVE-2017-16140.md): lab6.brit95 is a file server. (no CVSS, HackerOne lab6.brit95 node module · lab6.brit95)
- [CVE-2017-16141](https://cve.now/CVE-2017-16141.md): lab6drewfusbyu is an http server. (no CVSS, HackerOne lab6drewfusbyu node module · lab6drewfusbyu)
- [CVE-2017-16142](https://cve.now/CVE-2017-16142.md): infraserver is a RESTful server. (no CVSS, HackerOne infraserver node module · infraserver)
- [CVE-2017-16143](https://cve.now/CVE-2017-16143.md): commentapp.stetsonwood is an http server. (no CVSS, HackerOne commentapp.stetsonwood node module · commentapp.s…)
- [CVE-2017-16144](https://cve.now/CVE-2017-16144.md): myserver.alexcthomas18 is a file server. (no CVSS, HackerOne myserver.alexcthomas18 node module · myserver.ale…)
- [CVE-2017-16145](https://cve.now/CVE-2017-16145.md): sspa is a server dedicated to single-page apps. (no CVSS, HackerOne sspa node module · sspa)
- [CVE-2017-16146](https://cve.now/CVE-2017-16146.md): mockserve is a file server. (no CVSS, HackerOne mockserve node module · mockserve)
- [CVE-2017-16147](https://cve.now/CVE-2017-16147.md): shit-server is a file server. (no CVSS, HackerOne shit-server node module · shit-server)
- [CVE-2017-16148](https://cve.now/CVE-2017-16148.md): serve46 is a static file server. (no CVSS, HackerOne serve46 node module · serve46)
- [CVE-2017-16149](https://cve.now/CVE-2017-16149.md): zwserver is a weather web server. (no CVSS, HackerOne zwserver node module · zwserver)
- [CVE-2017-16150](https://cve.now/CVE-2017-16150.md): wanggoujing123 is a simple webserver. (no CVSS, HackerOne wangguojing123 node module · wangguojing123)
- [CVE-2017-16151](https://cve.now/CVE-2017-16151.md): Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects al (no CVSS, HackerOne electron node module · electron)
- [CVE-2017-16152](https://cve.now/CVE-2017-16152.md): static-html-server is a static file server. (no CVSS, HackerOne static-html-server node module · static-html-serv…)
- [CVE-2017-16154](https://cve.now/CVE-2017-16154.md): earlybird is a web server module for early development. (no CVSS, HackerOne earlybird node module · earlybird)
- [CVE-2017-16155](https://cve.now/CVE-2017-16155.md): fast-http-cli is the command line interface for fast-http, a simple web server. (no CVSS, HackerOne fast-http-cli node module · fast-http-cli)
- [CVE-2017-16156](https://cve.now/CVE-2017-16156.md): myprolyz is a static file server. (no CVSS, HackerOne myprolyz node module · myprolyz)
- [CVE-2017-16157](https://cve.now/CVE-2017-16157.md): censorify.tanisjr is a simple web server and API RESTful service. (no CVSS, HackerOne censorify.tanisjr node module · censorify.tanisjr)
- [CVE-2017-16158](https://cve.now/CVE-2017-16158.md): dcserver is a static file server. (no CVSS, HackerOne dcserver node module · dcserver)
- [CVE-2017-16159](https://cve.now/CVE-2017-16159.md): caolilinode is a simple file server. (no CVSS, HackerOne caolilinode node module · caolilinode)
- [CVE-2017-16160](https://cve.now/CVE-2017-16160.md): 11xiaoli is a simple file server. (no CVSS, HackerOne 11xiaoli node module · 11xiaoli)
- [CVE-2017-16161](https://cve.now/CVE-2017-16161.md): shenliru is a simple file server. (no CVSS, HackerOne shenliru node module · shenliru)
- [CVE-2017-16162](https://cve.now/CVE-2017-16162.md): 22lixian is a simple file server. (no CVSS, HackerOne 22lixian node module · 22lixian)
- [CVE-2017-16163](https://cve.now/CVE-2017-16163.md): dylmomo is a simple file server. (no CVSS, HackerOne dylmomo node module · dylmomo)
- [CVE-2017-16164](https://cve.now/CVE-2017-16164.md): desafio is a simple web server. (no CVSS, HackerOne desafio node module · desafio)
- [CVE-2017-16165](https://cve.now/CVE-2017-16165.md): calmquist.static-server is a static file server. (no CVSS, HackerOne calmquist.static-server node module · calmquist.s…)
- [CVE-2017-16166](https://cve.now/CVE-2017-16166.md): byucslabsix is an http server. (no CVSS, HackerOne byucslabsix node module · byucslabsix)
- [CVE-2017-16167](https://cve.now/CVE-2017-16167.md): yyooopack is a simple file server. (no CVSS, HackerOne yyooopack node module · yyooopack)
- [CVE-2017-16168](https://cve.now/CVE-2017-16168.md): wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. (no CVSS, HackerOne wffserve node module · wffserve)
- [CVE-2017-16169](https://cve.now/CVE-2017-16169.md): looppake is a simple http server. (no CVSS, HackerOne looppake node module · looppake)
- [CVE-2017-16170](https://cve.now/CVE-2017-16170.md): liuyaserver is a static file server. (no CVSS, HackerOne liuyaserver node module · liuyaserver)
- [CVE-2017-16171](https://cve.now/CVE-2017-16171.md): hcbserver is a static file server. (no CVSS, HackerOne hcbserver node module · hcbserver)
- [CVE-2017-16172](https://cve.now/CVE-2017-16172.md): section2.madisonjbrooks12 is a simple web server. (no CVSS, HackerOne section2.madisonjbrooks12 node module · section2.…)
- [CVE-2017-16173](https://cve.now/CVE-2017-16173.md): utahcityfinder constructs lists of Utah cities with a certain prefix. (no CVSS, HackerOne utahcityfinder node module · utahcityfinder)
- [CVE-2017-16174](https://cve.now/CVE-2017-16174.md): whispercast is a file server. (no CVSS, HackerOne whispercast node module · whispercast)
- [CVE-2017-16175](https://cve.now/CVE-2017-16175.md): ewgaddis.lab6 is a file server. (no CVSS, HackerOne ewgaddis.lab6 node module · ewgaddis.lab6)
- [CVE-2017-16176](https://cve.now/CVE-2017-16176.md): jansenstuffpleasework is a file server. (no CVSS, HackerOne jansenstuffpleasework node module · jansenstuffpl…)
- [CVE-2017-16177](https://cve.now/CVE-2017-16177.md): chatbyvista is a file server. (no CVSS, HackerOne chatbyvista node module · chatbyvista)
- [CVE-2017-16178](https://cve.now/CVE-2017-16178.md): intsol-package is a file server. (no CVSS, HackerOne intsol-package node module · intsol-package)
- [CVE-2017-16179](https://cve.now/CVE-2017-16179.md): dasafio is a web server. (no CVSS, HackerOne dasafio node module · dasafio)
- [CVE-2017-16180](https://cve.now/CVE-2017-16180.md): serverabc is a static file server. (no CVSS, HackerOne serverabc node module · serverabc)
- [CVE-2017-16181](https://cve.now/CVE-2017-16181.md): wintiwebdev is a static file server. (no CVSS, HackerOne wintiwebdev node module · wintiwebdev)
- [CVE-2017-16182](https://cve.now/CVE-2017-16182.md): serverxxx is a static file server. (no CVSS, HackerOne serverxxx node module · serverxxx)
- [CVE-2017-16183](https://cve.now/CVE-2017-16183.md): iter-server is a static file server. (no CVSS, iter-server)
- [CVE-2017-16184](https://cve.now/CVE-2017-16184.md): scott-blanch-weather-app is a sample Node.js app using Express 4. (no CVSS, HackerOne scott-blanch-weather-app node module · scott-blan…)
- [CVE-2017-16185](https://cve.now/CVE-2017-16185.md): uekw1511server is a static file server. (no CVSS, HackerOne uekw1511server node module · uekw1511server)
- [CVE-2017-16186](https://cve.now/CVE-2017-16186.md): 360class.jansenhm is a static file server. (no CVSS, HackerOne 360class.jansenhm node module · 360class.jansenhm)
- [CVE-2017-16187](https://cve.now/CVE-2017-16187.md): open-device creates a web interface for any device. (no CVSS, HackerOne open-device node module · open-device)
- [CVE-2017-16188](https://cve.now/CVE-2017-16188.md): reecerver is a web server. (no CVSS, HackerOne reecerver node module · reecerver)
- [CVE-2017-16189](https://cve.now/CVE-2017-16189.md): sly07 is an API for censoring text. (no CVSS, HackerOne sly07 node module · sly07)
- [CVE-2017-16190](https://cve.now/CVE-2017-16190.md): dcdcdcdcdc is a static file server. (no CVSS, HackerOne dcdcdcdcdc node module · dcdcdcdcdc)
- [CVE-2017-16191](https://cve.now/CVE-2017-16191.md): cypserver is a static file server. (no CVSS, HackerOne cypserver node module · cypserver)
- [CVE-2017-16192](https://cve.now/CVE-2017-16192.md): getcityapi.yoehoehne is a web server. (no CVSS, HackerOne getcityapi.yoehoehne node module · getcityapi.yoe…)
- [CVE-2017-16193](https://cve.now/CVE-2017-16193.md): mfrs is a static file server. (no CVSS, HackerOne mfrs node module · mfrs)
- [CVE-2017-16194](https://cve.now/CVE-2017-16194.md): picard is a micro framework. (no CVSS, HackerOne picard node module · picard)
- [CVE-2017-16195](https://cve.now/CVE-2017-16195.md): pytservce is a static file server. (no CVSS, HackerOne pytservce node module · pytservce)
- [CVE-2017-16196](https://cve.now/CVE-2017-16196.md): quickserver is a simple static file server. (no CVSS, HackerOne quickserver node module · quickserver)
- [CVE-2017-16197](https://cve.now/CVE-2017-16197.md): qinserve is a static file server. (no CVSS, HackerOne qinserve node module · qinserve)
- [CVE-2017-16198](https://cve.now/CVE-2017-16198.md): ritp is a static web server. (no CVSS, ritp)
- [CVE-2017-16199](https://cve.now/CVE-2017-16199.md): susu-sum is a static file server. (no CVSS, HackerOne susu-sum node module · susu-sum)
- [CVE-2017-16200](https://cve.now/CVE-2017-16200.md): uv-tj-demo is a static file server. (no CVSS, HackerOne uv-tj-demo node module · uv-tj-demo)
- [CVE-2017-16201](https://cve.now/CVE-2017-16201.md): zjjserver is a static file server. (no CVSS, HackerOne zjjserver node module · zjjserver)
- [CVE-2017-16202](https://cve.now/CVE-2017-16202.md): The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installat (no CVSS, HackerOne coffeescript node module · cofeescript)
- [CVE-2017-16203](https://cve.now/CVE-2017-16203.md): The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installa (no CVSS, HackerOne coffeescript node module · coffe-script)
- [CVE-2017-16204](https://cve.now/CVE-2017-16204.md): The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. (no CVSS, HackerOne jquey node module · jquey)
- [CVE-2017-16205](https://cve.now/CVE-2017-16205.md): The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installat (no CVSS, HackerOne coffeescript node module · coffescript)
- [CVE-2017-16206](https://cve.now/CVE-2017-16206.md): The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installa (no CVSS, cofee-script)
- [CVE-2017-16207](https://cve.now/CVE-2017-16207.md): discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. (no CVSS, HackerOne discordi.js node module · discordi.js)
- [CVE-2017-16208](https://cve.now/CVE-2017-16208.md): dmmcquay.lab6 is a REST server. (no CVSS, HackerOne dmmcquay.lab6 node module · dmmcquay.lab6)
- [CVE-2017-16209](https://cve.now/CVE-2017-16209.md): enserver is a simple web server. (no CVSS, HackerOne enserver node module · enserver)
- [CVE-2017-16210](https://cve.now/CVE-2017-16210.md): jn\_jj\_server is a static file server. (no CVSS, HackerOne jn\_jj\_server node module · jn\_jj\_server)
- [CVE-2017-16211](https://cve.now/CVE-2017-16211.md): lessindex is a static file server. (no CVSS, HackerOne lessindex node module · lessindex)
- [CVE-2017-16212](https://cve.now/CVE-2017-16212.md): ltt is a static file server. (no CVSS, HackerOne ltt node module · ltt)
- [CVE-2017-16213](https://cve.now/CVE-2017-16213.md): mfrserver is a simple file server. (no CVSS, HackerOne mfrserver node module · mfrserver)
- [CVE-2017-16214](https://cve.now/CVE-2017-16214.md): peiserver is a static file server. (no CVSS, HackerOne peiserver node module · peiserver)
- [CVE-2017-16215](https://cve.now/CVE-2017-16215.md): sgqserve is a simple file server. (no CVSS, HackerOne sgqserve node module · sgqserve)
- [CVE-2017-16216](https://cve.now/CVE-2017-16216.md): tencent-server is a simple web server. (no CVSS, HackerOne tencent-server node module · tencent-server)
- [CVE-2017-16217](https://cve.now/CVE-2017-16217.md): fbr-client sends files through sockets via socket.io and webRTC. (no CVSS, HackerOne fbr-client node module · fbr-client)
- [CVE-2017-16218](https://cve.now/CVE-2017-16218.md): dgard8.lab6 is a static file server. (no CVSS, HackerOne dgard8.lab6 node module · dgard8.lab6)
- [CVE-2017-16219](https://cve.now/CVE-2017-16219.md): yttivy is a static file server. (no CVSS, HackerOne yttivy node module · yttivy)
- [CVE-2017-16220](https://cve.now/CVE-2017-16220.md): wind-mvc is an mvc framework. (no CVSS, HackerOne wind-mvc node module · wind-mvc)
- [CVE-2017-16221](https://cve.now/CVE-2017-16221.md): yzt is a simple file server. (no CVSS, HackerOne yzt node module · yzt)
- [CVE-2017-16222](https://cve.now/CVE-2017-16222.md): elding is a simple web server. (no CVSS, HackerOne elding node module · elding)
- [CVE-2017-16223](https://cve.now/CVE-2017-16223.md): nodeaaaaa is a static file server. (no CVSS, HackerOne nodeaaaaa node module · nodeaaaaa)
- [CVE-2017-16224](https://cve.now/CVE-2017-16224.md): st is a module for serving static files. (no CVSS, HackerOne st node module · st)
- [CVE-2017-16225](https://cve.now/CVE-2017-16225.md): aegir is a module to help automate JavaScript project management. (no CVSS, HackerOne aegir node module · aegir)
- [CVE-2017-16226](https://cve.now/CVE-2017-16226.md): The static-eval module is intended to evaluate statically-analyzable expressions. (no CVSS, HackerOne static-eval node module node module · static-eval)
- [CVE-2018-3711](https://cve.now/CVE-2018-3711.md): Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and (no CVSS, HackerOne fastify node module · fastify)
- [CVE-2018-3712](https://cve.now/CVE-2018-3712.md): serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in path (no CVSS, HackerOne serve node module · serve)
- [CVE-2018-3713](https://cve.now/CVE-2018-3713.md): angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a ma (no CVSS, HackerOne angular-http-server node module · angular-http-se…)
- [CVE-2018-3714](https://cve.now/CVE-2018-3714.md): node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read con (no CVSS, HackerOne node-srv node module · node-srv)
- [CVE-2018-3715](https://cve.now/CVE-2018-3715.md): glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a m (no CVSS, HackerOne glance node module · glance)
- [CVE-2018-3716](https://cve.now/CVE-2018-3716.md): simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. (no CVSS, HackerOne simplehttpserver node module · simplehttpserver)
- [CVE-2018-3717](https://cve.now/CVE-2018-3717.md): connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.j (no CVSS, HackerOne connect node module · connect)
- [CVE-2018-3718](https://cve.now/CVE-2018-3718.md): serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded. (no CVSS, HackerOne serve node module · serve)
- [CVE-2018-3719](https://cve.now/CVE-2018-3719.md): mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use (no CVSS, HackerOne mixin-deep node module · mixin-deep)
- [CVE-2018-3720](https://cve.now/CVE-2018-3720.md): assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us (no CVSS, HackerOne assign-deep node module · assign-deep)
- [CVE-2018-3721](https://cve.now/CVE-2018-3721.md): lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer (no CVSS, HackerOne lodash node module · lodash +1)
- [CVE-2018-3722](https://cve.now/CVE-2018-3722.md): merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use (no CVSS, HackerOne merge-deep node module · merge-deep)
- [CVE-2018-3723](https://cve.now/CVE-2018-3723.md): defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious (no CVSS, HackerOne defaults-deep node module · defaults-deep)
- [CVE-2018-3724](https://cve.now/CVE-2018-3724.md): general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious (no CVSS, HackerOne general-file-server node module · general-file-se…)
- [CVE-2018-3725](https://cve.now/CVE-2018-3725.md): hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read conte (no CVSS, HackerOne hekto node module · hekto)
- [CVE-2018-3726](https://cve.now/CVE-2018-3726.md): crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. (no CVSS, HackerOne crud-file-server node module · crud-file-server)
- [CVE-2018-3727](https://cve.now/CVE-2018-3727.md): 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content (no CVSS, HackerOne 626 node module · 626)
- [CVE-2018-3729](https://cve.now/CVE-2018-3729.md): localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to re (no CVSS, HackerOne localhost-now node module · localhost-now)
- [CVE-2018-3730](https://cve.now/CVE-2018-3730.md): mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to rea (no CVSS, HackerOne mcstatic node module · mcstatic)
- [CVE-2018-3731](https://cve.now/CVE-2018-3731.md): public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read (no CVSS, HackerOne public node module · public)
- [CVE-2018-3732](https://cve.now/CVE-2018-3732.md): resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special ch (no CVSS, HackerOne resolve-path node module · resolve-path)
- [CVE-2018-3735](https://cve.now/CVE-2018-3735.md): bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template (no CVSS, HackerOne bracket-template node module · bracket-template)
- [CVE-2018-3737](https://cve.now/CVE-2018-3737.md): sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. (no CVSS, HackerOne sshpk node module · sshpk)
- [CVE-2018-3738](https://cve.now/CVE-2018-3738.md): protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. (no CVSS, HackerOne protobufjs node module · protobufjs)
- [CVE-2018-3739](https://cve.now/CVE-2018-3739.md): https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized (no CVSS, HackerOne https-proxy-agent node module · https-proxy-agent)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.