Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16108gaoxiaotingtingting is an HTTP server.npm · gaoxiaotingtingting
- CVE-2017-16109easyquick is a simple web server.npm · easyquick
- CVE-2017-16110weather.swlyons is a simple web server for weather updates.npm · weather.swlyons
- CVE-2017-16111The content module is a module to parse HTTP Content-* headers.npm · content · fixed in 3.0.7
- CVE-2017-16113The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.npm · parsejson
- CVE-2017-16114The marked module is vulnerable to a regular expression denial of service.npm · marked · fixed in 0.3.9
- CVE-2017-16115The timespan module is vulnerable to regular expression denial of service.npm · timespan
- CVE-2017-16116The string module is a module that provides extra string operations.npm · string
- CVE-2017-16117slug is a module to slugify strings, even if they contain unicode.npm · slug · fixed in 0.9.2
- CVE-2017-16118The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header.npm · forwarded · fixed in 0.1.2
- CVE-2017-16119Fresh is a module used by the Express.js framework for HTTP response freshness testing.npm · fresh · fixed in 0.5.2
- CVE-2017-16120liyujing is a static file server.npm · liyujing
- CVE-2017-16121datachannel-client is a signaling implementation for DataChannel.js.npm · datachannel-client
- CVE-2017-16122cuciuci is a simple fileserver.npm · cuciuci
- CVE-2017-16123welcomyzt is a simple file server.npm · welcomyzt
- CVE-2017-16124node-server-forfront is a simple static file server.npm · node-server-forfront
- CVE-2017-16125rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager.npm · rtcmulticonnection-client
- CVE-2017-16126The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem.npm · botbait
- CVE-2017-16127The module pandora-doomsday infects other modules.npm · pandora-doomsday
- CVE-2017-16128The module npm-script-demo opened a connection to a command and control server.npm · npm-script-demo
- CVE-2017-16129The HTTP client module superagent is vulnerable to ZIP bomb attacks.npm · superagent · fixed in 3.7.0
- CVE-2017-16130exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide.npm · exxxxxxxxxxx
- CVE-2017-16131unicorn-list is a web framework.npm · unicorn-list
- CVE-2017-16132simple-npm-registry is a local npm package cache.npm · simple-npm-registry
- CVE-2017-16133goserv is an http server.npm · goserv
- CVE-2017-16134http_static_simple is an http server.npm · http_static_simple
- CVE-2017-16135serverzyy is a static file server.npm · serverzyy
- CVE-2017-16136method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesnpm · method-override · fixed in 2.3.10
- CVE-2017-16137The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.npm · debug · fixed in 2.6.9, 3.1.0, 3.2.7 and more
- CVE-2017-16138The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted usenpm · mime · fixed in 2.0.3, 1.4.1