Hackerone vulnerabilities
470 CVEs and advisories name Hackerone as an affected vendor, newest first. Follow it as a feed.
- CVE-2016-10574apk-parser3 is a module to extract Android Manifest info from an APK file.
- CVE-2018-3755XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element u
- CVE-2018-3746The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on th
- CVE-2018-3743Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.
- CVE-2016-10572mongodb-instance before 0.0.3 installs mongodb locally.
- CVE-2016-10571bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, whi
- CVE-2016-10569embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags.
- CVE-2016-10565operadriver is a Opera Driver for Selenium.
- CVE-2016-10564apk-parser is a tool to extract Android Manifest info from an APK file.
- CVE-2016-10563During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP.
- CVE-2016-10562iedriver is an NPM wrapper for Selenium IEDriver.
- CVE-2016-10561Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`.
- CVE-2016-10560galenframework-cli is the node wrapper for the Galen Framework.
- CVE-2016-10557appium-chromedriver is a Node.js wrapper around Chromedriver.
- CVE-2016-10555Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent t
- CVE-2016-10554sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server i
- CVE-2016-10553sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server i
- CVE-2016-10552igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
- CVE-2016-10550sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server i
- CVE-2016-10549Sails is an MVC style framework for building realtime web applications.
- CVE-2016-10548Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css.
- CVE-2016-10547Nunjucks is a full featured templating engine for JavaScript.
- CVE-2016-10546An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and de
- CVE-2016-10544uws is a WebSocket server library.
- CVE-2016-10543call is an HTTP router that is primarily used by the hapi framework.
- CVE-2016-10542ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455".
- CVE-2016-10541The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell.
- CVE-2016-10540Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects.
- CVE-2016-10539negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.
- CVE-2016-10538The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file.