Hackerone vulnerabilities
470 CVEs and advisories name Hackerone as an affected vendor, newest first. Follow it as a feed.
- CVE-2016-10537backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your R
- CVE-2016-10536engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatio
- CVE-2016-10535csrf-lite is a cross-site request forgery protection library for framework-less node sites.
- CVE-2016-10534electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages.
- CVE-2016-10533express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models.
- CVE-2016-10532console-io is a module that allows users to implement a web console in their application.
- CVE-2016-10531marked is an application that is meant to parse and compile markdown.
- CVE-2016-10530The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP.
- CVE-2016-10529Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests.
- CVE-2016-10528restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web.
- CVE-2016-10527The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions
- CVE-2016-10526A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth p
- CVE-2016-10524i18n-node-angular is a module used to interact between i18n and angular without using additional resources.
- CVE-2016-10523MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible wit
- CVE-2016-10521jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress v
- CVE-2016-10520jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
- CVE-2016-10519A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and
- CVE-2016-10518A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping
- CVE-2015-9239ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
- CVE-2015-9238secure-compare 3.0.0 and below do not actually compare two strings properly.
- CVE-2015-9236Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at w
- CVE-2014-10066Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal.
- CVE-2014-10065Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for
- CVE-2014-10064The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply ne
- CVE-2018-3745atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
- CVE-2018-3744The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
- CVE-2018-3734stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read con
- CVE-2018-3733crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a mal
- CVE-2017-16153gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
- CVE-2017-16062node-tkinter was a malicious module published with the intent to hijack environment variables.