Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-10556 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T03:47:51.757Z Vendors: HackerOne Products: sequelize node module Problem Types: CWE-89 Description: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHE
could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sequelize/sequelize/issues/5671 - https://nodesecurity.io/advisories/102
CVE ID: CVE-2016-10557 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T02:16:19.032Z Vendors: HackerOne Products: appium-chromedriver node module Problem Types: CWE-311 Description: appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/1
the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/162
CVE ID: CVE-2016-10558 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T02:36:42.182Z Vendors: HackerOne Products: aerospike node module Problem Types: CWE-311 Description: aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/167
CVE ID: CVE-2016-10559 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T17:18:02.860Z Vendors: HackerOne Products: selenium-download node module Problem Types: CWE-311 Description: selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: Referen
work or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/164
CVE ID: CVE-2016-10560 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T00:40:36.154Z Vendors: HackerOne Products: galenframework-cli node module Problem Types: CWE-311 Description: galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisorie
nd the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/170
CVE ID: CVE-2016-10561 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T04:24:57.968Z Vendors: HackerOne Products: bitty node module Problem Types: CWE-22 Description: Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/150
CVE ID: CVE-2016-10562 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T04:14:46.356Z Vendors: HackerOne Products: iedriver node module Problem Types: CWE-311 Description: iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/174
CVE ID: CVE-2016-10563 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T18:49:48.687Z Vendors: HackerOne Products: go-ipfs-dep node module Problem Types: CWE-311 Description: During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/156 - https://github.com/diasdavid/go-ipfs-dep/pull/12
CVE ID: CVE-2016-10564 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-17T01:26:03.354Z Vendors: HackerOne Products: apk-parser node module Problem Types: CWE-311 Description: apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisori
and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/195
CVE ID: CVE-2016-10565 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T22:15:55.926Z Vendors: HackerOne Products: operadriver node module Problem Types: CWE-311 Description: operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/196
CVE ID: CVE-2016-10566 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T02:52:25.988Z Vendors: HackerOne Products: install-nw node module Problem Types: CWE-311 Description: install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/adv
user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/204
CVE ID: CVE-2016-10567 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T17:48:59.372Z Vendors: HackerOne Products: product-monitor node module Problem Types: CWE-311 Description: product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacke
s. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/171
CVE ID: CVE-2016-10568 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T19:35:14.748Z Vendors: HackerOne Products: geoip-lite-country node module Problem Types: CWE-311 Description: geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/183
CVE ID: CVE-2016-10569 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T17:39:03.270Z Vendors: HackerOne Products: embedza node module Problem Types: CWE-311 Description: embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Conta
is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/187
CVE ID: CVE-2016-10570 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T18:43:52.168Z Vendors: HackerOne Products: pngcrush-installer node module Problem Types: CWE-311 Description: pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/189
CVE ID: CVE-2016-10571 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T18:19:33.273Z Vendors: HackerOne Products: bkjs-wand node module Problem Types: CWE-311 Description: bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/22
he remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/220
CVE ID: CVE-2016-10572 State: PUBLISHED Published: 2018-05-31T20:00:00Z Last Updated: 2024-09-16T17:33:41.577Z Vendors: HackerOne Products: mongodb-instance node module Problem Types: CWE-311 Description: mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/235
CVE ID: CVE-2016-10573 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T18:34:31.669Z Vendors: HackerOne Products: baryton-saxophone node module Problem Types: CWE-311 Description: baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: Referenc
ork or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/240
CVE ID: CVE-2016-10574 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-16T16:58:41.863Z Vendors: HackerOne Products: apk-parser3 node module Problem Types: CWE-311 Description: apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/ad
user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/245
CVE ID: CVE-2016-10575 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-17T02:36:12.983Z Vendors: HackerOne Products: kindlegen node module Problem Types: CWE-311 Description: Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisori
and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/251
CVE ID: CVE-2016-10576 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-17T01:21:20.514Z Vendors: HackerOne Products: fuseki node module Problem Types: CWE-311 Description: Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/278
CVE ID: CVE-2016-10577 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T20:31:37.904Z Vendors: HackerOne Products: ibm_db node module Problem Types: CWE-311 Description: ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ibmdb/node-
r and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ibmdb/node-ibm_db/commit/d7e2d4b4cbeb6f067df8bba7d0b2ac5d40fcfc19#diff-315091eb1586966006e05ebc21cd2a94 - https://nodesecurity.io/advisories/163
CVE ID: CVE-2016-10578 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T01:11:45.242Z Vendors: HackerOne Products: unicode node module Problem Types: CWE-311 Description: unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/161
CVE ID: CVE-2016-10579 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-16T17:58:08.508Z Vendors: HackerOne Products: chromedriver node module Problem Types: CWE-311 Description: Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/160
CVE ID: CVE-2016-10580 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-17T01:21:50.851Z Vendors: HackerOne Products: nodewebkit node module Problem Types: CWE-311 Description: nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/173
CVE ID: CVE-2016-10581 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-16T18:33:59.022Z Vendors: HackerOne Products: steroids node module Problem Types: CWE-311 Description: Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: Refere
twork or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/168
CVE ID: CVE-2016-10582 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-16T19:05:13.678Z Vendors: HackerOne Products: closurecompiler node module Problem Types: CWE-311 Description: closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/169
CVE ID: CVE-2016-10583 State: PUBLISHED Published: 2018-06-01T18:00:00 Last Updated: 2024-08-06T03:30:19.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/165
CVE ID: CVE-2016-10584 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T16:53:28.723Z Vendors: HackerOne Products: dalek-browser-chrome-canary node module Problem Types: CWE-311 Description: dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecur
tween the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/181
CVE ID: CVE-2016-10585 State: PUBLISHED Published: 2018-06-01T18:00:00Z Last Updated: 2024-09-17T00:02:18.653Z Vendors: HackerOne Products: libxl node module Problem Types: CWE-311 Description: libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity
en the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/178
CVE ID: CVE-2016-10586 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T16:38:53.614Z Vendors: HackerOne Products: macaca-chromedriver node module Problem Types: CWE-311 Description: macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity
en the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/180