Hackerone vulnerabilities
470 CVEs and advisories name Hackerone as an affected vendor, newest first. Follow it as a feed.
- CVE-2018-3735bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
- CVE-2018-3732resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special ch
- CVE-2018-3731public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read
- CVE-2018-3730mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to rea
- CVE-2018-3729localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to re
- CVE-2018-3727626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content
- CVE-2018-3726crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
- CVE-2018-3725hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read conte
- CVE-2018-3724general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious
- CVE-2018-3723defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious
- CVE-2018-3722merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use
- CVE-2018-3721lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mer
- CVE-2018-3720assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious us
- CVE-2018-3719mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious use
- CVE-2018-3718serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
- CVE-2018-3717connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.j
- CVE-2018-3716simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
- CVE-2018-3715glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a m
- CVE-2018-3714node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read con
- CVE-2018-3713angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a ma
- CVE-2018-3712serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in path
- CVE-2018-3711Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and
- CVE-2017-16226The static-eval module is intended to evaluate statically-analyzable expressions.
- CVE-2017-16225aegir is a module to help automate JavaScript project management.
- CVE-2017-16224st is a module for serving static files.
- CVE-2017-16223nodeaaaaa is a static file server.
- CVE-2017-16222elding is a simple web server.
- CVE-2017-16221yzt is a simple file server.
- CVE-2017-16220wind-mvc is an mvc framework.
- CVE-2017-16219yttivy is a static file server.