Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/garycourt/uri-js/issues/12 - https://nodesecurity.io/advisories/100
CVE ID: CVE-2017-16022 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T21:08:55.440Z Vendors: HackerOne Products: Morris.js node module Problem Types: CWE-79 Description: Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/307 - https://github.com/morrisjs/morris.js/pull/464
CVE ID: CVE-2017-16023 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:01:40.957Z Vendors: HackerOne Products: decamelize node module Problem Types: CWE-400 Description: Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sindresorhus/decamelize/issues/5 - https://nodesecurity.io/advisories/308
CVE ID: CVE-2017-16024 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:48:58.293Z Vendors: HackerOne Products: sync-exec node module Problem Types: CWE-377 Description: The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/377.html - https://www.owasp.org/index.php/Insecure_T
am Container: References: - https://cwe.mitre.org/data/definitions/377.html - https://www.owasp.org/index.php/Insecure_Temporary_File - https://github.com/gvarsanyi/sync-exec/issues/17 - https://nodesecurity.io/advisories/310
CVE ID: CVE-2017-16025 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:12:03.298Z Vendors: HackerOne Products: nes node module Problem Types: CWE-400 Description: Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/331 - https://github.com/hapijs/nes/issues/171 - ht
Program Container: References: - https://nodesecurity.io/advisories/331 - https://github.com/hapijs/nes/issues/171 - https://github.com/hapijs/nes/commit/249ba1755ed6977fbc208463c87364bf884ad655
CVE ID: CVE-2017-16026 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:28:08.484Z Vendors: HackerOne Products: request node module Problem Types: CWE-201 Description: Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/request/request/pull/2018 - https://nodesecurity.io/advisories/309 - https://github.com/request/request/issues/1904
CVE ID: CVE-2017-16028 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T02:06:18.622Z Vendors: HackerOne Products: react-native-meteor-oauth node module Problem Types: CWE-330 Description: react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tableflip/react-native-meteor-oauth/blob/a7eb738b74c469f5db20296b44b7cae4e2337435/src/meteor-oauth.js#L66 - https://nodesecurity.io/advisories/157
CVE ID: CVE-2017-16029 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T00:11:57.294Z Vendors: HackerOne Products: hostr node module Problem Types: CWE-22 Description: hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/henrytseng/hostr/issues/8 - https://nodesecurity.io/advisories/303
CVE ID: CVE-2017-16030 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T00:41:28.696Z Vendors: HackerOne Products: useragent node module Problem Types: CWE-400 Description: Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/312
CVE ID: CVE-2017-16031 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T21:07:25.207Z Vendors: HackerOne Products: socket.io node module Problem Types: Account Hijacking Description: Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 - https://githu
ner: References: - https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 - https://github.com/socketio/socket.io/issues/856 - https://github.com/socketio/socket.io/pull/857 - https://nodesecurity.io/advisories/321
CVE ID: CVE-2017-16035 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:26:31.843Z Vendors: HackerOne Products: hubl-server node module Problem Types: CWE-311 Description: The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation. Additional Analyst Notes: - CVE Prog
rforming a package installation could compromise the integrity of the installation. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/334
CVE ID: CVE-2017-16036 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T02:47:21.539Z Vendors: HackerOne Products: badjs-sourcemap-server node module Problem Types: CWE-22 Description: `badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/349 - https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/badjs-sourcemap-server
CVE ID: CVE-2017-16037 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T22:19:45.670Z Vendors: HackerOne Products: gomeplus-h5-proxy node module Problem Types: CWE-22 Description: `gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/gomeplus-h5-proxy - https://nodesecurity.io/advisories/350
CVE ID: CVE-2017-16038 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T19:19:36.920Z Vendors: HackerOne Products: f2e-server node module Problem Types: Account Hijacking Description: `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shy2850/node-server/issues/10 - https://github.com/shy2850/node-server/pull/12/files - https://nodesecurity.io/advisories/346
CVE ID: CVE-2017-16039 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T02:47:23.736Z Vendors: HackerOne Products: hftp node module Problem Types: CWE-22 Description: `hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/384 - https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/hftp
CVE ID: CVE-2017-16040 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T19:14:22.506Z Vendors: HackerOne Products: gfe-sass node module Problem Types: CWE-311 Description: gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/291
CVE ID: CVE-2017-16041 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:55:33.643Z Vendors: HackerOne Products: ikst node module Problem Types: CWE-311 Description: ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/249
CVE ID: CVE-2017-16042 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:08:21.801Z Vendors: HackerOne Products: growl node module Problem Types: CWE-94 Description: Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/146 - https://github.com/tj/node-growl/pull/61 - https://github.com/tj/node-growl/issues/60
CVE ID: CVE-2017-16043 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T16:58:10.449Z Vendors: HackerOne Products: shout node module Problem Types: CWE-80 Description: Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erming/shout/pull/344 - https://nodesecurity.io/advisories/322
CVE ID: CVE-2017-16044 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T00:21:50.833Z Vendors: HackerOne Products: d3.js node module Problem Types: CWE-506 Description: `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/497
CVE ID: CVE-2017-16045 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T18:28:45.804Z Vendors: HackerOne Products: jquery.js node module Problem Types: CWE-506 Description: `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/496
CVE ID: CVE-2017-16046 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T22:50:41.688Z Vendors: HackerOne Products: mariadb node module Problem Types: CWE-506 Description: `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/495
CVE ID: CVE-2017-16047 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T22:51:47.555Z Vendors: HackerOne Products: mysqljs node module Problem Types: CWE-506 Description: mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/494
CVE ID: CVE-2017-16048 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T19:00:59.500Z Vendors: HackerOne Products: node-sqlite node module Problem Types: CWE-506 Description: `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/493
CVE ID: CVE-2017-16049 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:46:17.496Z Vendors: HackerOne Products: nodesqlite node module Problem Types: CWE-506 Description: `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/492
CVE ID: CVE-2017-16050 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T23:05:46.606Z Vendors: HackerOne Products: sqlite.js node module Problem Types: CWE-506 Description: `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/491
CVE ID: CVE-2017-16051 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:36:13.920Z Vendors: HackerOne Products: sqliter node module Problem Types: CWE-506 Description: `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/490
CVE ID: CVE-2017-16052 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:05:54.584Z Vendors: HackerOne Products: node-fabric node module Problem Types: CWE-506 Description: `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/489
CVE ID: CVE-2017-16053 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:14:00.858Z Vendors: HackerOne Products: fabric-js node module Problem Types: CWE-506 Description: `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/487
CVE ID: CVE-2017-16054 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T23:36:57.788Z Vendors: HackerOne Products: nodefabric node module Problem Types: CWE-506 Description: `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/488
CVE ID: CVE-2017-16055 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:10:56.654Z Vendors: HackerOne Products: sqlserver node module Problem Types: CWE-506 Description: `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/486
CVE ID: CVE-2017-16056 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T16:23:54.756Z Vendors: HackerOne Products: mssql.js node module Problem Types: CWE-506 Description: mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/485
CVE ID: CVE-2017-16057 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T00:15:50.693Z Vendors: HackerOne Products: nodemssql node module Problem Types: CWE-506 Description: nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/484
CVE ID: CVE-2017-16058 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T19:14:31.734Z Vendors: HackerOne Products: gruntcli node module Problem Types: CWE-506 Description: gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/498
CVE ID: CVE-2017-16059 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T00:01:42.895Z Vendors: HackerOne Products: mssql-node node module Problem Types: CWE-506 Description: mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/480
CVE ID: CVE-2017-16060 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T03:48:25.761Z Vendors: HackerOne Products: babelcli node module Problem Types: CWE-506 Description: babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/499
CVE ID: CVE-2017-16061 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T19:01:00.831Z Vendors: HackerOne Products: tkinter node module Problem Types: CWE-506 Description: tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/500
CVE ID: CVE-2017-16062 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T17:18:57.339Z Vendors: HackerOne Products: node-tkinter node module Problem Types: CWE-506 Description: node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/501
CVE ID: CVE-2017-16063 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T17:53:48.445Z Vendors: HackerOne Products: node-opensl node module Problem Types: CWE-506 Description: node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/502
CVE ID: CVE-2017-16064 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T03:19:02.079Z Vendors: HackerOne Products: node-openssl node module Problem Types: CWE-506 Description: node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/503
CVE ID: CVE-2017-16065 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T00:37:05.170Z Vendors: HackerOne Products: openssl.js node module Problem Types: CWE-506 Description: openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/504
CVE ID: CVE-2017-16066 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T04:14:23.387Z Vendors: HackerOne Products: opencv.js node module Problem Types: CWE-506 Description: opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/505
CVE ID: CVE-2017-16067 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T17:14:25.481Z Vendors: HackerOne Products: node-opencv node module Problem Types: CWE-506 Description: node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/506
CVE ID: CVE-2017-16068 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:12:02.148Z Vendors: HackerOne Products: ffmepg node module Problem Types: CWE-506 Description: ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/507
CVE ID: CVE-2017-16069 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T16:57:46.862Z Vendors: HackerOne Products: nodeffmpeg node module Problem Types: CWE-506 Description: nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/508
CVE ID: CVE-2017-16070 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T04:29:04.270Z Vendors: HackerOne Products: nodecaffe node module Problem Types: CWE-506 Description: nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/509
CVE ID: CVE-2017-16071 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T01:25:34.845Z Vendors: HackerOne Products: nodemailer-js node module Problem Types: CWE-506 Description: nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/510