Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-15973 State: PUBLISHED Published: 2017-10-29T06:00:00 Last Updated: 2024-08-05T20:13:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/144443/Sokial-Social-Network-Script-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/43086/
CVE ID: CVE-2017-15974 State: PUBLISHED Published: 2017-10-29T06:00:00 Last Updated: 2024-08-05T20:13:06.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43085/ - https://packetstormsecurity.com/files/144444/tPanel-2009-SQL-Injection.html
CVE ID: CVE-2017-15975 State: PUBLISHED Published: 2017-10-29T06:00:00 Last Updated: 2024-08-05T20:13:06.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/144445/Vastal-I-Tech-Dating-Zone-0.9.9-SQL-Injection.html - https://www.exploit-db.com/exploits/43084/
CVE ID: CVE-2017-15976 State: PUBLISHED Published: 2017-10-29T06:00:00 Last Updated: 2024-08-05T20:13:06.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43083/ - https://packetstormsecurity.com/files/144446/ZeeBuddy-2x-SQL-Injection.html
CVE ID: CVE-2017-15977 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43082/
CVE ID: CVE-2017-15978 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43081/
CVE ID: CVE-2017-15979 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43080/
CVE ID: CVE-2017-15980 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43079/
CVE ID: CVE-2017-15981 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43078/
CVE ID: CVE-2017-15982 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43077/
CVE ID: CVE-2017-15983 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43076/
CVE ID: CVE-2017-15984 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43075/
CVE ID: CVE-2017-15985 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43074/
CVE ID: CVE-2017-15986 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: CPA Lead Reward Script allows SQL Injection via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43073/
CVE ID: CVE-2017-15987 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43072/
CVE ID: CVE-2017-15988 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43071/
CVE ID: CVE-2017-15989 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43070/
CVE ID: CVE-2017-15990 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43069/
CVE ID: CVE-2017-15991 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43068/
CVE ID: CVE-2017-15992 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43067/
CVE ID: CVE-2017-15993 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-05T20:13:06.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43066/
CVE ID: CVE-2017-15994 State: PUBLISHED Published: 2017-10-29T06:00:00 Last Updated: 2024-08-05T20:13:06.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects. Additional Analyst Notes: - CVE Program Container: References: - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3 - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=c252546ceeb0925eb
ommit%3Bh=7b8a4ecd6ff9cdf4e5d3850ebf822f1e989255b3 - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=c252546ceeb0925eb8a4061315e3ff0a8c55b48b - https://git.samba.org/?p=rsync.git%3Ba=commit%3Bh=9a480deec4d20277d8e20bc55515ef0640ca1e55
CVE ID: CVE-2017-15996 State: PUBLISHED Published: 2017-10-29T17:00:00 Last Updated: 2024-08-05T20:13:06.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101608 - https://s
ns. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101608 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d91f0b20e561e326ee91a09a76206257bde8438b - https://security.gentoo.org/glsa/201801-01 - https://sourceware.org/bugzilla/show_bug.cgi?id=22361
CVE ID: CVE-2017-15997 State: PUBLISHED Published: 2017-10-29T17:00:00Z Last Updated: 2024-09-17T00:51:39.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file. Additional Analyst Notes: - CVE Program Container: References: - https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE ID: CVE-2017-15998 State: PUBLISHED Published: 2017-10-29T17:00:00Z Last Updated: 2024-09-17T03:23:23.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE ID: CVE-2017-15999 State: PUBLISHED Published: 2017-10-29T17:00:00Z Last Updated: 2024-09-16T18:43:44.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required. Additional Analyst Notes: - CVE Program Container: References: - https://1337sec.blogspot.de/2017/10/auditing-nq-contacts-backup-restore-11.html
CVE ID: CVE-2017-16000 State: PUBLISHED Published: 2017-10-29T17:00:00Z Last Updated: 2024-09-17T01:00:59.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jsj730sos/cve/blob/master/Eonweb_module_capacity_per_label_index.php-SQL%20injection%20vulnerability
CVE ID: CVE-2017-16001 State: PUBLISHED Published: 2017-11-06T17:00:00 Last Updated: 2024-08-05T20:13:06.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43220/ - https://m4.rkw.io/blog/cve201716001-local-root-privesc-in-hashicorp-vagrantvmwarefusion-501.html
CVE ID: CVE-2017-16003 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T03:13:33.305Z Vendors: HackerOne Products: windows-build-tools node module Problem Types: CWE-311 Description: windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https:
ioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/304 - https://github.com/felixrieseberg/windows-build-tools/commit/9835d33e68f2cb5e4d148e954bb3ed0221d98e90
CVE ID: CVE-2017-16005 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T19:19:33.991Z Vendors: HackerOne Products: http-signature node module Problem Types: CWE-20 Description: Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyent/node-http-signature/issues/10 - htt
onal Analyst Notes: - CVE Program Container: References: - https://github.com/joyent/node-http-signature/issues/10 - https://nodesecurity.io/advisories/318
CVE ID: CVE-2017-16006 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T03:01:59.476Z Vendors: HackerOne Products: remarkable node module Problem Types: CWE-79 Description: Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jonschlinkert/remarkable/issues/227 - https://nodesecurity.io/advisories/319
CVE ID: CVE-2017-16007 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T18:23:49.490Z Vendors: HackerOne Products: node-jose node module Problem Types: CWE-200 Description: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27
tional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae - https://nodesecurity.io/advisories/324 - http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html - https://github.com/cisco/node-jose
CVE ID: CVE-2017-16008 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:53:16.453Z Vendors: HackerOne Products: i18next node module Problem Types: CWE-79 Description: i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/325 - https://github.com/i18next/i18next/pull/443
CVE ID: CVE-2017-16009 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T02:41:23.964Z Vendors: HackerOne Products: ag-grid node module Problem Types: CWE-79 Description: ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid. Additional Analyst Notes: - CVE Program Container: References: - https://spring.io/blog/2016/01/28/angularjs-escaping-the-expression-sandbox-for-xss - https://nodesecurity.io/advisories/327 - https://github.com/ceolter/ag-grid/issues/1287
CVE ID: CVE-2017-16010 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T18:38:55.446Z Vendors: HackerOne Products: i18next node module Problem Types: CWE-79 Description: i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i18next/i18next/pull/826 - https://nodesecurity.io/advisories/326
CVE ID: CVE-2017-16011 State: REJECTED Published: 2018-06-04T19:00:00 Last Updated: 2018-06-26T16:57:01 Description: No description available.
CVE ID: CVE-2017-16012 State: REJECTED Published: 2018-06-04T19:00:00 Last Updated: 2018-06-26T16:57:01 Description: No description available.
CVE ID: CVE-2017-16013 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T04:09:41.605Z Vendors: HackerOne Products: hapi node module Problem Types: CWE-400 Description: hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/335 - https://github.com/hapijs/hapi/issues/3466
CVE ID: CVE-2017-16014 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T21:57:09.433Z Vendors: HackerOne Products: http-proxy node module Problem Types: CWE-703 Description: Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nodejitsu/node-http-proxy/pull/101 - https://nodesecurity.io/advisories/323
CVE ID: CVE-2017-16015 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T22:56:32.290Z Vendors: HackerOne Products: forms node module Problem Types: CWE-80 Description: Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d - https://nodesecurity.io/advisories/158
CVE ID: CVE-2017-16016 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:46:48.797Z Vendors: HackerOne Products: sanitize-html node module Problem Types: CWE-79 Description: Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/154 - https://github.com/punkave/sanitize-html/issues/100 - https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
CVE ID: CVE-2017-16017 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:40:49.487Z Vendors: HackerOne Products: sanitize-html node module Problem Types: CWE-79 Description: sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/punkave/sanitize-html/pull/20 - https://nodesecurity.io/advisories/155 - https://github.com/punkave/sanitize-html/issues/19
CVE ID: CVE-2017-16018 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T17:54:46.223Z Vendors: HackerOne Products: restify node module Problem Types: CWE-79 Description: Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/314 - https://github.com/restify/node-restify/issues/1018
CVE ID: CVE-2017-16019 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T23:35:38.065Z Vendors: HackerOne Products: gitbook node module Problem Types: CWE-79 Description: GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/159 - https://github.com/GitbookIO/gitbook/issues/1609
CVE ID: CVE-2017-16020 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T20:06:20.093Z Vendors: HackerOne Products: summit node module Problem Types: CWE-94 Description: Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/notduncansmith/summit/issues/23 - https://nodesecurity.io/advisories/315
CVE ID: CVE-2017-16021 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T01:46:00.192Z Vendors: HackerOne Products: uri-js node module Problem Types: CWE-400 Description: uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This af