Hackerone vulnerabilities
470 CVEs and advisories name Hackerone as an affected vendor, newest first. Follow it as a feed.
- CVE-2016-10566install-nw is a module which quickly and robustly installs and caches NW.js.
- CVE-2016-10559selenium-download downloads the latest versions of the selenium standalone server and the chromedriver.
- CVE-2016-10558aerospike is an Aerospike add-on module for Node.js.
- CVE-2016-10556sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server i
- CVE-2016-10551waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contai
- CVE-2016-10525When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass aut
- CVE-2015-9244Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
- CVE-2015-9243When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leve
- CVE-2015-9242Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception.
- CVE-2015-9241Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised.
- CVE-2015-9240Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched
- CVE-2015-9235In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmet
- CVE-2014-10068The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`
- CVE-2014-10067paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productio
- CVE-2017-0909The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network add
- CVE-2017-0903RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.
- CVE-2017-0898Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus val
- CVE-2017-0902RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client
- CVE-2017-0901RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any f
- CVE-2017-0899RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.