Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-10523 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T02:15:35.059Z Vendors: HackerOne Products: mqtt-packet node module Problem Types: CWE-400 Description: MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mcollina/mosca/issues/393 - https://nodesecurity.io/advisories/75 - https://github.com/mqttjs/mqtt-packet/pull/8
CVE ID: CVE-2016-10524 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T17:27:42.388Z Vendors: HackerOne Products: i18n-node-angular node module Problem Types: CWE-400 Description: i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/80 - https://github.com/oliversalzburg/i18n-node-angular/commit/877
er: References: - https://nodesecurity.io/advisories/80 - https://github.com/oliversalzburg/i18n-node-angular/commit/877720d2d9bb90dc8233706e81ffa03f99fc9dc8
CVE ID: CVE-2016-10525 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T01:01:50.306Z Vendors: HackerOne Products: hapi-auth-jwt2 node module Problem Types: Improper Authentication Description: When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/81 - https://github.com/dwyl/hapi-auth-jwt2/pull/112 - https://github.com/dwyl/hapi-auth-jwt2/issues/111
CVE ID: CVE-2016-10526 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T20:37:56.998Z Vendors: HackerOne Products: grunt-gh-pages node module Problem Types: CWE-391 Description: A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tschaub/grunt-gh-pages/pull/41 - https://nodesecurit
st Notes: - CVE Program Container: References: - https://github.com/tschaub/grunt-gh-pages/pull/41 - https://nodesecurity.io/advisories/85
CVE ID: CVE-2016-10527 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:16:35.976Z Vendors: HackerOne Products: riot-compiler node module Problem Types: CWE-400 Description: The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/86 - https://github.com/riot/compiler/issues/46
CVE ID: CVE-2016-10528 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:30:39.884Z Vendors: HackerOne Products: restafary node module Problem Types: CWE-22 Description: restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/89
CVE ID: CVE-2016-10529 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T18:33:59.616Z Vendors: HackerOne Products: droppy node module Problem Types: CWE-352 Description: Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/91
CVE ID: CVE-2016-10530 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T17:48:45.037Z Vendors: HackerOne Products: airbrake node module Problem Types: CWE-200 Description: The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/airbrake/node-airbrake/issues/70 - https://nodesecurity.io/a
: - CVE Program Container: References: - https://github.com/airbrake/node-airbrake/issues/70 - https://nodesecurity.io/advisories/96
CVE ID: CVE-2016-10531 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T04:28:55.235Z Vendors: HackerOne Products: marked node module Problem Types: CWE-79 Description: marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisor
`anything;` being left. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/101 - https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523 - https://github.com/chjj/marked/pull/592
CVE ID: CVE-2016-10532 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T22:03:05.480Z Vendors: HackerOne Products: console-io node module Problem Types: Improper Authentication Description: console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allo
lnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/90
CVE ID: CVE-2016-10533 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T00:35:52.804Z Vendors: HackerOne Products: express-restify-mongoose node module Problem Types: CWE-200 Description: express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes. Additional Analyst Notes: - CV
ther private data if the malicious user knew what was set as private for specific routes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/florianholzapfel/express-restify-mongoose/issues/252 - https://nodesecurity.io/advisories/92
CVE ID: CVE-2016-10534 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T02:37:40.090Z Vendors: HackerOne Products: electron-packager node module Problem Types: CWE-295 Description: electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/electron-userland/electron-packager/issues/333 - https://nodesecu
VE Program Container: References: - https://github.com/electron-userland/electron-packager/issues/333 - https://nodesecurity.io/advisories/104
CVE ID: CVE-2016-10535 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:30:58.704Z Vendors: HackerOne Products: csrf-lite node module Problem Types: CWE-208 Description: csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/94 - https://github.com/isaacs/csrf-lite/pull/1
CVE ID: CVE-2016-10536 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:46:42.911Z Vendors: HackerOne Products: engine.io-client node module Problem Types: CWE-300 Description: engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, wheth
engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off. Additional Analyst Notes: - CVE Program Container: References: - https://www.cigital.com/blog/node-js-socket-io/ - https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1 - https://nodesecurity.io/advisories/99
CVE ID: CVE-2016-10537 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T04:14:50.404Z Vendors: HackerOne Products: backbone node module Problem Types: CWE-79 Description: backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecu
nversion of things such as `<` to `<`. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/108 - https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008
CVE ID: CVE-2016-10538 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:36:47.221Z Vendors: HackerOne Products: cli node module Problem Types: CWE-22 Description: The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252 - https://github.com/node-js-libs/cli/issues/81 - https://nodesecurity.io/advisories/95
CVE ID: CVE-2016-10539 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T02:11:28.261Z Vendors: HackerOne Products: negotiator node module Problem Types: CWE-400 Description: negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/106
CVE ID: CVE-2016-10540 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T19:24:48.196Z Vendors: HackerOne Products: minimatch node module Problem Types: CWE-400 Description: Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/118
CVE ID: CVE-2016-10541 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T03:18:50.154Z Vendors: HackerOne Products: shell-quote node module Problem Types: CWE-78 Description: The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/117 - https://github.com/advisories/GHSA-qg8p-v9q4-gh34
CVE ID: CVE-2016-10542 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T04:03:37.757Z Vendors: HackerOne Products: ws node module Problem Types: CWE-400 Description: ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nodejs/node/issues/7388 - https://nodesecurity.io/advisories/120
CVE ID: CVE-2016-10543 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T00:22:05.189Z Vendors: HackerOne Products: call node module Problem Types: CWE-20 Description: call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hapijs/hapi/issues/3228 - https://nodesecurity.io/advisories/121
CVE ID: CVE-2016-10544 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T02:56:54.139Z Vendors: HackerOne Products: uws node module Problem Types: CWE-400 Description: uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.co
. This affects uws >=0.10.0 <=0.10.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9 - https://nodesecurity.io/advisories/149
CVE ID: CVE-2016-10545 State: REJECTED Published: 2018-07-05T16:00:00 Last Updated: 2018-07-06T19:57:02 Description: No description available.
CVE ID: CVE-2016-10546 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T17:07:44.297Z Vendors: HackerOne Products: pouchdb node module Problem Types: CWE-94 Description: An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/143
CVE ID: CVE-2016-10547 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T16:43:50.537Z Vendors: HackerOne Products: nunjucks node module Problem Types: CWE-79 Description: Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/nunjucks/issues/835 - https://nodesecur
Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/nunjucks/issues/835 - https://nodesecurity.io/advisories/147 - https://github.com/matt-/nunjucks_test
CVE ID: CVE-2016-10548 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T20:03:43.284Z Vendors: HackerOne Products: reduce-css-calc node module Problem Types: CWE-94 Description: Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9 - https://nodesecurity.io/advisories/144
CVE ID: CVE-2016-10549 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:46:02.640Z Vendors: HackerOne Products: sails node module Problem Types: CWE-284 Description: Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is se
y bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible. Additional Analyst Notes: - CVE Program Container: References: - http://sailsjs.org/documentation/concepts/security/cors - https://nodesecurity.io/advisories/148 - http://sailsjs.org/documentation/reference/configuration/sails-config-cors
CVE ID: CVE-2016-10550 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T23:31:50.320Z Vendors: HackerOne Products: sequelize node module Problem Types: CWE-89 Description: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/112 - https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e5
s: - https://nodesecurity.io/advisories/112 - https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
CVE ID: CVE-2016-10551 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T16:58:50.345Z Vendors: HackerOne Products: waterline-sequel node module Problem Types: CWE-89 Description: waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balderdashy/waterline/issues/1
base. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530 - https://nodesecurity.io/advisories/115
CVE ID: CVE-2016-10552 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T22:20:09.664Z Vendors: HackerOne Products: igniteui node module Problem Types: CWE-311 Description: igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/116
CVE ID: CVE-2016-10553 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T00:16:46.372Z Vendors: HackerOne Products: sequelize node module Problem Types: CWE-89 Description: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/109 - https://github.com/sequelize/sequelize/blob/master/changelog.md#300
CVE ID: CVE-2016-10554 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:55:55.539Z Vendors: HackerOne Products: sequelize node module Problem Types: CWE-89 Description: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d - https://nodesecurity.io/advisories/113
CVE ID: CVE-2016-10555 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T16:38:09.923Z Vendors: HackerOne Products: jwt-simple node module Problem Types: CWE-20 Description: Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/87 - https://github.com/hokaccha/node-jwt-simpl
CVE Program Container: References: - https://nodesecurity.io/advisories/87 - https://github.com/hokaccha/node-jwt-simple/pull/14 - https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ - https://github.com/hokaccha/node-jwt-simple/pull/16