# cve.now: Hackerone

The newest entries naming Hackerone as an affected vendor (up to 200), of 470 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2017-0938](https://cve.now/CVE-2017-0938.md): Denial of Service attack in airMAX \< 8.3.2 , airMAX \< 6.0.7 and EdgeMAX \< 1.9.7 allow attackers to use the Discovery Protocol in amplificati (no CVSS)
- [CVE-2018-16493](https://cve.now/CVE-2018-16493.md): A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the serv (no CVSS)
- [CVE-2018-16492](https://cve.now/CVE-2018-16492.md): A prototype pollution vulnerability was found in module extend \<2.0.2, ~\<3.0.2 that allows an attacker to inject arbitrary properties onto O (no CVSS)
- [CVE-2018-16491](https://cve.now/CVE-2018-16491.md): A prototype pollution vulnerability was found in node.extend \<1.1.7, ~\<2.0.1 that allows an attacker to inject arbitrary properties onto Obj (no CVSS)
- [CVE-2018-16490](https://cve.now/CVE-2018-16490.md): A prototype pollution vulnerability was found in module mpath \<0.5.1 that allows an attacker to inject arbitrary properties onto Object.prot (no CVSS)
- [CVE-2018-16489](https://cve.now/CVE-2018-16489.md): A prototype pollution vulnerability was found in just-extend \<4.0.0 that allows attack to inject properties onto Object.prototype through it (no CVSS)
- [CVE-2018-16487](https://cve.now/CVE-2018-16487.md): A prototype pollution vulnerability was found in lodash \<4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into (no CVSS)
- [CVE-2018-16486](https://cve.now/CVE-2018-16486.md): A prototype pollution vulnerability was found in defaults-deep \<=0.2.4 that would allow a malicious user to inject properties onto Object.pr (no CVSS)
- [CVE-2018-16485](https://cve.now/CVE-2018-16485.md): Path Traversal vulnerability in module m-server \<1.4.1 allows malicious user to access unauthorized content of any file in the directory tre (no CVSS)
- [CVE-2018-16484](https://cve.now/CVE-2018-16484.md): A XSS vulnerability was found in module m-server \<1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of esc (no CVSS)
- [CVE-2018-16483](https://cve.now/CVE-2018-16483.md): A deficiency in the access control in module express-cart \<=1.1.5 allows unprivileged users to add new users to the application as administr (no CVSS)
- [CVE-2018-16482](https://cve.now/CVE-2018-16482.md): A server directory traversal vulnerability was found on node module mcstatic \<=0.0.20 that would allow an attack to access sensitive informa (no CVSS)
- [CVE-2018-16481](https://cve.now/CVE-2018-16481.md): A XSS vulnerability was found in html-page \<=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the abs (no CVSS)
- [CVE-2018-16480](https://cve.now/CVE-2018-16480.md): A XSS vulnerability was found in module public \<0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of san (no CVSS)
- [CVE-2018-16479](https://cve.now/CVE-2018-16479.md): Path traversal vulnerability in http-live-simulator \<1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes (no CVSS)
- [CVE-2018-16469](https://cve.now/CVE-2018-16469.md): The merge.recursive function in the merge package \<1.2.1 can be tricked into adding or modifying properties of the Object prototype. (no CVSS)
- [CVE-2018-3787](https://cve.now/CVE-2018-3787.md): Path traversal in simplehttpserver \<v0.2.1 allows listing any file on the server. (no CVSS)
- [CVE-2018-3776](https://cve.now/CVE-2018-3776.md): Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit lo (no CVSS)
- [CVE-2018-3775](https://cve.now/CVE-2018-3775.md): Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 F (no CVSS)
- [CVE-2018-3774](https://cve.now/CVE-2018-3774.md): Incorrect parsing in url-parse \<1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Aut (no CVSS)
- [CVE-2018-3779](https://cve.now/CVE-2018-3779.md): active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdo (no CVSS)
- [CVE-2018-3778](https://cve.now/CVE-2018-3778.md): Improper authorization in aedes version \<0.35.0 will publish a LWT in a channel when a client is not authorized. (no CVSS)
- [CVE-2018-3771](https://cve.now/CVE-2018-3771.md): An XSS in statics-server \<= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browse (no CVSS)
- [CVE-2018-3770](https://cve.now/CVE-2018-3770.md): A path traversal exists in markdown-pdf version \<9.0.0 that allows a user to insert a malicious html code that can result in reading the loc (no CVSS)
- [CVE-2018-3760](https://cve.now/CVE-2018-3760.md): There is an information leak vulnerability in Sprockets. (no CVSS)
- [CVE-2018-3759](https://cve.now/CVE-2018-3759.md): private\_address\_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sock (no CVSS)
- [CVE-2018-3758](https://cve.now/CVE-2018-3758.md): Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine. (no CVSS)
- [CVE-2018-3739](https://cve.now/CVE-2018-3739.md): https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized (no CVSS)
- [CVE-2018-3738](https://cve.now/CVE-2018-3738.md): protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. (no CVSS)
- [CVE-2018-3737](https://cve.now/CVE-2018-3737.md): sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. (no CVSS)
- [CVE-2018-3735](https://cve.now/CVE-2018-3735.md): bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template (no CVSS)
- [CVE-2018-3732](https://cve.now/CVE-2018-3732.md): resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special ch (no CVSS)
- [CVE-2018-3731](https://cve.now/CVE-2018-3731.md): public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read (no CVSS)
- [CVE-2018-3730](https://cve.now/CVE-2018-3730.md): mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to rea (no CVSS)
- [CVE-2018-3729](https://cve.now/CVE-2018-3729.md): localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to re (no CVSS)
- [CVE-2018-3727](https://cve.now/CVE-2018-3727.md): 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content (no CVSS)
- [CVE-2018-3726](https://cve.now/CVE-2018-3726.md): crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. (no CVSS)
- [CVE-2018-3725](https://cve.now/CVE-2018-3725.md): hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read conte (no CVSS)
- [CVE-2018-3724](https://cve.now/CVE-2018-3724.md): general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious (no CVSS)
- [CVE-2018-3723](https://cve.now/CVE-2018-3723.md): defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious (no CVSS)
- [CVE-2018-3722](https://cve.now/CVE-2018-3722.md): merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use (no CVSS)
- [CVE-2018-3721](https://cve.now/CVE-2018-3721.md): lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer (no CVSS)
- [CVE-2018-3720](https://cve.now/CVE-2018-3720.md): assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us (no CVSS)
- [CVE-2018-3719](https://cve.now/CVE-2018-3719.md): mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use (no CVSS)
- [CVE-2018-3718](https://cve.now/CVE-2018-3718.md): serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded. (no CVSS)
- [CVE-2018-3717](https://cve.now/CVE-2018-3717.md): connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.j (no CVSS)
- [CVE-2018-3716](https://cve.now/CVE-2018-3716.md): simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names. (no CVSS)
- [CVE-2018-3715](https://cve.now/CVE-2018-3715.md): glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a m (no CVSS)
- [CVE-2018-3714](https://cve.now/CVE-2018-3714.md): node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read con (no CVSS)
- [CVE-2018-3713](https://cve.now/CVE-2018-3713.md): angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a ma (no CVSS)
- [CVE-2018-3712](https://cve.now/CVE-2018-3712.md): serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in path (no CVSS)
- [CVE-2018-3711](https://cve.now/CVE-2018-3711.md): Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and (no CVSS)
- [CVE-2017-16226](https://cve.now/CVE-2017-16226.md): The static-eval module is intended to evaluate statically-analyzable expressions. (no CVSS)
- [CVE-2017-16225](https://cve.now/CVE-2017-16225.md): aegir is a module to help automate JavaScript project management. (no CVSS)
- [CVE-2017-16224](https://cve.now/CVE-2017-16224.md): st is a module for serving static files. (no CVSS)
- [CVE-2017-16223](https://cve.now/CVE-2017-16223.md): nodeaaaaa is a static file server. (no CVSS)
- [CVE-2017-16222](https://cve.now/CVE-2017-16222.md): elding is a simple web server. (no CVSS)
- [CVE-2017-16221](https://cve.now/CVE-2017-16221.md): yzt is a simple file server. (no CVSS)
- [CVE-2017-16220](https://cve.now/CVE-2017-16220.md): wind-mvc is an mvc framework. (no CVSS)
- [CVE-2017-16219](https://cve.now/CVE-2017-16219.md): yttivy is a static file server. (no CVSS)
- [CVE-2017-16218](https://cve.now/CVE-2017-16218.md): dgard8.lab6 is a static file server. (no CVSS)
- [CVE-2017-16217](https://cve.now/CVE-2017-16217.md): fbr-client sends files through sockets via socket.io and webRTC. (no CVSS)
- [CVE-2017-16216](https://cve.now/CVE-2017-16216.md): tencent-server is a simple web server. (no CVSS)
- [CVE-2017-16215](https://cve.now/CVE-2017-16215.md): sgqserve is a simple file server. (no CVSS)
- [CVE-2017-16214](https://cve.now/CVE-2017-16214.md): peiserver is a static file server. (no CVSS)
- [CVE-2017-16213](https://cve.now/CVE-2017-16213.md): mfrserver is a simple file server. (no CVSS)
- [CVE-2017-16212](https://cve.now/CVE-2017-16212.md): ltt is a static file server. (no CVSS)
- [CVE-2017-16211](https://cve.now/CVE-2017-16211.md): lessindex is a static file server. (no CVSS)
- [CVE-2017-16210](https://cve.now/CVE-2017-16210.md): jn\_jj\_server is a static file server. (no CVSS)
- [CVE-2017-16209](https://cve.now/CVE-2017-16209.md): enserver is a simple web server. (no CVSS)
- [CVE-2017-16208](https://cve.now/CVE-2017-16208.md): dmmcquay.lab6 is a REST server. (no CVSS)
- [CVE-2017-16207](https://cve.now/CVE-2017-16207.md): discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. (no CVSS)
- [CVE-2017-16205](https://cve.now/CVE-2017-16205.md): The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installat (no CVSS)
- [CVE-2017-16204](https://cve.now/CVE-2017-16204.md): The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. (no CVSS)
- [CVE-2017-16203](https://cve.now/CVE-2017-16203.md): The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installa (no CVSS)
- [CVE-2017-16202](https://cve.now/CVE-2017-16202.md): The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installat (no CVSS)
- [CVE-2017-16201](https://cve.now/CVE-2017-16201.md): zjjserver is a static file server. (no CVSS)
- [CVE-2017-16200](https://cve.now/CVE-2017-16200.md): uv-tj-demo is a static file server. (no CVSS)
- [CVE-2017-16199](https://cve.now/CVE-2017-16199.md): susu-sum is a static file server. (no CVSS)
- [CVE-2017-16197](https://cve.now/CVE-2017-16197.md): qinserve is a static file server. (no CVSS)
- [CVE-2017-16196](https://cve.now/CVE-2017-16196.md): quickserver is a simple static file server. (no CVSS)
- [CVE-2017-16195](https://cve.now/CVE-2017-16195.md): pytservce is a static file server. (no CVSS)
- [CVE-2017-16194](https://cve.now/CVE-2017-16194.md): picard is a micro framework. (no CVSS)
- [CVE-2017-16193](https://cve.now/CVE-2017-16193.md): mfrs is a static file server. (no CVSS)
- [CVE-2017-16192](https://cve.now/CVE-2017-16192.md): getcityapi.yoehoehne is a web server. (no CVSS)
- [CVE-2017-16191](https://cve.now/CVE-2017-16191.md): cypserver is a static file server. (no CVSS)
- [CVE-2017-16190](https://cve.now/CVE-2017-16190.md): dcdcdcdcdc is a static file server. (no CVSS)
- [CVE-2017-16189](https://cve.now/CVE-2017-16189.md): sly07 is an API for censoring text. (no CVSS)
- [CVE-2017-16188](https://cve.now/CVE-2017-16188.md): reecerver is a web server. (no CVSS)
- [CVE-2017-16187](https://cve.now/CVE-2017-16187.md): open-device creates a web interface for any device. (no CVSS)
- [CVE-2017-16186](https://cve.now/CVE-2017-16186.md): 360class.jansenhm is a static file server. (no CVSS)
- [CVE-2017-16185](https://cve.now/CVE-2017-16185.md): uekw1511server is a static file server. (no CVSS)
- [CVE-2017-16184](https://cve.now/CVE-2017-16184.md): scott-blanch-weather-app is a sample Node.js app using Express 4. (no CVSS)
- [CVE-2017-16182](https://cve.now/CVE-2017-16182.md): serverxxx is a static file server. (no CVSS)
- [CVE-2017-16181](https://cve.now/CVE-2017-16181.md): wintiwebdev is a static file server. (no CVSS)
- [CVE-2017-16180](https://cve.now/CVE-2017-16180.md): serverabc is a static file server. (no CVSS)
- [CVE-2017-16179](https://cve.now/CVE-2017-16179.md): dasafio is a web server. (no CVSS)
- [CVE-2017-16178](https://cve.now/CVE-2017-16178.md): intsol-package is a file server. (no CVSS)
- [CVE-2017-16177](https://cve.now/CVE-2017-16177.md): chatbyvista is a file server. (no CVSS)
- [CVE-2017-16176](https://cve.now/CVE-2017-16176.md): jansenstuffpleasework is a file server. (no CVSS)
- [CVE-2017-16175](https://cve.now/CVE-2017-16175.md): ewgaddis.lab6 is a file server. (no CVSS)
- [CVE-2017-16174](https://cve.now/CVE-2017-16174.md): whispercast is a file server. (no CVSS)
- [CVE-2017-16173](https://cve.now/CVE-2017-16173.md): utahcityfinder constructs lists of Utah cities with a certain prefix. (no CVSS)
- [CVE-2017-16172](https://cve.now/CVE-2017-16172.md): section2.madisonjbrooks12 is a simple web server. (no CVSS)
- [CVE-2017-16171](https://cve.now/CVE-2017-16171.md): hcbserver is a static file server. (no CVSS)
- [CVE-2017-16170](https://cve.now/CVE-2017-16170.md): liuyaserver is a static file server. (no CVSS)
- [CVE-2017-16169](https://cve.now/CVE-2017-16169.md): looppake is a simple http server. (no CVSS)
- [CVE-2017-16168](https://cve.now/CVE-2017-16168.md): wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. (no CVSS)
- [CVE-2017-16167](https://cve.now/CVE-2017-16167.md): yyooopack is a simple file server. (no CVSS)
- [CVE-2017-16166](https://cve.now/CVE-2017-16166.md): byucslabsix is an http server. (no CVSS)
- [CVE-2017-16165](https://cve.now/CVE-2017-16165.md): calmquist.static-server is a static file server. (no CVSS)
- [CVE-2017-16164](https://cve.now/CVE-2017-16164.md): desafio is a simple web server. (no CVSS)
- [CVE-2017-16163](https://cve.now/CVE-2017-16163.md): dylmomo is a simple file server. (no CVSS)
- [CVE-2017-16162](https://cve.now/CVE-2017-16162.md): 22lixian is a simple file server. (no CVSS)
- [CVE-2017-16161](https://cve.now/CVE-2017-16161.md): shenliru is a simple file server. (no CVSS)
- [CVE-2017-16160](https://cve.now/CVE-2017-16160.md): 11xiaoli is a simple file server. (no CVSS)
- [CVE-2017-16159](https://cve.now/CVE-2017-16159.md): caolilinode is a simple file server. (no CVSS)
- [CVE-2017-16158](https://cve.now/CVE-2017-16158.md): dcserver is a static file server. (no CVSS)
- [CVE-2017-16157](https://cve.now/CVE-2017-16157.md): censorify.tanisjr is a simple web server and API RESTful service. (no CVSS)
- [CVE-2017-16156](https://cve.now/CVE-2017-16156.md): myprolyz is a static file server. (no CVSS)
- [CVE-2017-16155](https://cve.now/CVE-2017-16155.md): fast-http-cli is the command line interface for fast-http, a simple web server. (no CVSS)
- [CVE-2017-16154](https://cve.now/CVE-2017-16154.md): earlybird is a web server module for early development. (no CVSS)
- [CVE-2017-16152](https://cve.now/CVE-2017-16152.md): static-html-server is a static file server. (no CVSS)
- [CVE-2017-16151](https://cve.now/CVE-2017-16151.md): Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects al (no CVSS)
- [CVE-2017-16150](https://cve.now/CVE-2017-16150.md): wanggoujing123 is a simple webserver. (no CVSS)
- [CVE-2017-16149](https://cve.now/CVE-2017-16149.md): zwserver is a weather web server. (no CVSS)
- [CVE-2017-16148](https://cve.now/CVE-2017-16148.md): serve46 is a static file server. (no CVSS)
- [CVE-2017-16147](https://cve.now/CVE-2017-16147.md): shit-server is a file server. (no CVSS)
- [CVE-2017-16146](https://cve.now/CVE-2017-16146.md): mockserve is a file server. (no CVSS)
- [CVE-2017-16145](https://cve.now/CVE-2017-16145.md): sspa is a server dedicated to single-page apps. (no CVSS)
- [CVE-2017-16144](https://cve.now/CVE-2017-16144.md): myserver.alexcthomas18 is a file server. (no CVSS)
- [CVE-2017-16143](https://cve.now/CVE-2017-16143.md): commentapp.stetsonwood is an http server. (no CVSS)
- [CVE-2017-16142](https://cve.now/CVE-2017-16142.md): infraserver is a RESTful server. (no CVSS)
- [CVE-2017-16141](https://cve.now/CVE-2017-16141.md): lab6drewfusbyu is an http server. (no CVSS)
- [CVE-2017-16140](https://cve.now/CVE-2017-16140.md): lab6.brit95 is a file server. (no CVSS)
- [CVE-2017-16139](https://cve.now/CVE-2017-16139.md): jikes is a file server. (no CVSS)
- [CVE-2017-16138](https://cve.now/CVE-2017-16138.md): The mime module \< 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted use (CVSS 7.5)
- [CVE-2017-16137](https://cve.now/CVE-2017-16137.md): The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. (no CVSS)
- [CVE-2017-16136](https://cve.now/CVE-2017-16136.md): method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client does (no CVSS)
- [CVE-2017-16135](https://cve.now/CVE-2017-16135.md): serverzyy is a static file server. (no CVSS)
- [CVE-2017-16134](https://cve.now/CVE-2017-16134.md): http\_static\_simple is an http server. (no CVSS)
- [CVE-2017-16133](https://cve.now/CVE-2017-16133.md): goserv is an http server. (no CVSS)
- [CVE-2017-16132](https://cve.now/CVE-2017-16132.md): simple-npm-registry is a local npm package cache. (no CVSS)
- [CVE-2017-16131](https://cve.now/CVE-2017-16131.md): unicorn-list is a web framework. (no CVSS)
- [CVE-2017-16130](https://cve.now/CVE-2017-16130.md): exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. (no CVSS)
- [CVE-2017-16129](https://cve.now/CVE-2017-16129.md): The HTTP client module superagent is vulnerable to ZIP bomb attacks. (no CVSS)
- [CVE-2017-16128](https://cve.now/CVE-2017-16128.md): The module npm-script-demo opened a connection to a command and control server. (no CVSS)
- [CVE-2017-16127](https://cve.now/CVE-2017-16127.md): The module pandora-doomsday infects other modules. (no CVSS)
- [CVE-2017-16125](https://cve.now/CVE-2017-16125.md): rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. (no CVSS)
- [CVE-2017-16124](https://cve.now/CVE-2017-16124.md): node-server-forfront is a simple static file server. (no CVSS)
- [CVE-2017-16123](https://cve.now/CVE-2017-16123.md): welcomyzt is a simple file server. (no CVSS)
- [CVE-2017-16122](https://cve.now/CVE-2017-16122.md): cuciuci is a simple fileserver. (no CVSS)
- [CVE-2017-16121](https://cve.now/CVE-2017-16121.md): datachannel-client is a signaling implementation for DataChannel.js. (no CVSS)
- [CVE-2017-16120](https://cve.now/CVE-2017-16120.md): liyujing is a static file server. (no CVSS)
- [CVE-2017-16119](https://cve.now/CVE-2017-16119.md): Fresh is a module used by the Express.js framework for HTTP response freshness testing. (CVSS 7.5)
- [CVE-2017-16118](https://cve.now/CVE-2017-16118.md): The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. (no CVSS)
- [CVE-2017-16117](https://cve.now/CVE-2017-16117.md): slug is a module to slugify strings, even if they contain unicode. (no CVSS)
- [CVE-2017-16116](https://cve.now/CVE-2017-16116.md): The string module is a module that provides extra string operations. (no CVSS)
- [CVE-2017-16115](https://cve.now/CVE-2017-16115.md): The timespan module is vulnerable to regular expression denial of service. (no CVSS)
- [CVE-2017-16114](https://cve.now/CVE-2017-16114.md): The marked module is vulnerable to a regular expression denial of service. (no CVSS)
- [CVE-2017-16113](https://cve.now/CVE-2017-16113.md): The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. (no CVSS)
- [CVE-2017-16111](https://cve.now/CVE-2017-16111.md): The content module is a module to parse HTTP Content-\* headers. (no CVSS)
- [CVE-2017-16110](https://cve.now/CVE-2017-16110.md): weather.swlyons is a simple web server for weather updates. (no CVSS)
- [CVE-2017-16109](https://cve.now/CVE-2017-16109.md): easyquick is a simple web server. (no CVSS)
- [CVE-2017-16108](https://cve.now/CVE-2017-16108.md): gaoxiaotingtingting is an HTTP server. (no CVSS)
- [CVE-2017-16107](https://cve.now/CVE-2017-16107.md): pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. (no CVSS)
- [CVE-2017-16106](https://cve.now/CVE-2017-16106.md): tmock is a static file server. (no CVSS)
- [CVE-2017-16105](https://cve.now/CVE-2017-16105.md): serverwzl is a simple http server. (no CVSS)
- [CVE-2017-16104](https://cve.now/CVE-2017-16104.md): citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url (no CVSS)
- [CVE-2017-16103](https://cve.now/CVE-2017-16103.md): serveryztyzt is a simple http server. (no CVSS)
- [CVE-2017-16102](https://cve.now/CVE-2017-16102.md): serverhuwenhui is a simple http server. (no CVSS)
- [CVE-2017-16101](https://cve.now/CVE-2017-16101.md): serverwg is a simple http server. (no CVSS)
- [CVE-2017-16100](https://cve.now/CVE-2017-16100.md): dns-sync is a sync/blocking dns resolver. (no CVSS)
- [CVE-2017-16099](https://cve.now/CVE-2017-16099.md): The no-case module is vulnerable to regular expression denial of service. (no CVSS)
- [CVE-2017-16098](https://cve.now/CVE-2017-16098.md): charset 1.0.0 and below are vulnerable to regular expression denial of service. (no CVSS)
- [CVE-2017-16097](https://cve.now/CVE-2017-16097.md): tiny-http is a simple http server. (no CVSS)
- [CVE-2017-16096](https://cve.now/CVE-2017-16096.md): serveryaozeyan is a simple HTTP server. (no CVSS)
- [CVE-2017-16095](https://cve.now/CVE-2017-16095.md): serverliujiayi1 is a simple http server. (no CVSS)
- [CVE-2017-16094](https://cve.now/CVE-2017-16094.md): iter-http is a server for static files. (no CVSS)
- [CVE-2017-16093](https://cve.now/CVE-2017-16093.md): cyber-js is a simple http server. (no CVSS)
- [CVE-2017-16092](https://cve.now/CVE-2017-16092.md): Sencisho is a simple http server for local development. (no CVSS)
- [CVE-2017-16091](https://cve.now/CVE-2017-16091.md): xtalk helps your browser talk to nodex, a simple web framework. (no CVSS)
- [CVE-2017-16090](https://cve.now/CVE-2017-16090.md): fsk-server is a simple http server. (no CVSS)
- [CVE-2017-16089](https://cve.now/CVE-2017-16089.md): serverlyr is a simple http server. (no CVSS)
- [CVE-2017-16088](https://cve.now/CVE-2017-16088.md): The safe-eval module describes itself as a safer version of eval. (no CVSS)
- [CVE-2017-16086](https://cve.now/CVE-2017-16086.md): ua-parser is a port of Browserscope's user agent parser. (no CVSS)
- [CVE-2017-16085](https://cve.now/CVE-2017-16085.md): tinyserver2 is a webserver for static files. (no CVSS)
- [CVE-2017-16084](https://cve.now/CVE-2017-16084.md): list-n-stream is a server for static files to list and stream local videos. (no CVSS)
- [CVE-2017-16083](https://cve.now/CVE-2017-16083.md): node-simple-router is a minimalistic router for Node. (no CVSS)
- [CVE-2017-16082](https://cve.now/CVE-2017-16082.md): A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column (no CVSS)
- [CVE-2017-16081](https://cve.now/CVE-2017-16081.md): cross-env.js was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16080](https://cve.now/CVE-2017-16080.md): nodesass was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16079](https://cve.now/CVE-2017-16079.md): smb was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16078](https://cve.now/CVE-2017-16078.md): shadowsock was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16077](https://cve.now/CVE-2017-16077.md): mongose was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16076](https://cve.now/CVE-2017-16076.md): proxy.js was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16075](https://cve.now/CVE-2017-16075.md): http-proxy.js was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16074](https://cve.now/CVE-2017-16074.md): crossenv was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16073](https://cve.now/CVE-2017-16073.md): noderequest was a malicious module published with the intent to hijack environment variables. (no CVSS)
- [CVE-2017-16072](https://cve.now/CVE-2017-16072.md): nodemailer.js was a malicious module published with the intent to hijack environment variables. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hackerone
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.