Hackerone vulnerabilities
470 CVEs and advisories name Hackerone as an affected vendor, newest first. Follow it as a feed.
- CVE-2017-0938Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificati
- CVE-2018-16493A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the serv
- CVE-2018-16492A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto O
- CVE-2018-16491A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Obj
- CVE-2018-16490A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prot
- CVE-2018-16489A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through it
- CVE-2018-16487A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into
- CVE-2018-16486A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.pr
- CVE-2018-16485Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tre
- CVE-2018-16484A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of esc
- CVE-2018-16483A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administr
- CVE-2018-16482A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive informa
- CVE-2018-16481A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the abs
- CVE-2018-16480A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of san
- CVE-2018-16479Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes
- CVE-2018-16469The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.
- CVE-2018-3787Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
- CVE-2018-3776Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit lo
- CVE-2018-3775Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 F
- CVE-2018-3774Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Aut
- CVE-2018-3779active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdo
- CVE-2018-3778Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
- CVE-2018-3771An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browse
- CVE-2018-3770A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the loc
- CVE-2018-3760There is an information leak vulnerability in Sprockets.
- CVE-2018-3759private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sock
- CVE-2018-3758Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
- CVE-2018-3739https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized
- CVE-2018-3738protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- CVE-2018-3737sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.