deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-16072
Published: 2018-06-07
Description: nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/511; https://nodesecurity.io/advisories/511
CVE: CVE-2017-16073
Published: 2018-06-07
Description: noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/512; https://nodesecurity.io/advisories/512
CVE: CVE-2017-16074
Published: 2018-06-07
Description: crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/513; https://nodesecurity.io/advisories/513
CVE: CVE-2017-16075
Published: 2018-06-07
Description: http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/514; https://nodesecurity.io/advisories/514
CVE: CVE-2017-16076
Published: 2018-06-07
Description: proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/515; https://nodesecurity.io/advisories/515
CVE: CVE-2017-16077
Published: 2018-06-07
Description: mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/516; https://nodesecurity.io/advisories/516
CVE: CVE-2017-16078
Published: 2018-06-07
Description: shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/517; https://nodesecurity.io/advisories/517
CVE: CVE-2017-16079
Published: 2018-06-07
Description: smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/518; https://nodesecurity.io/advisories/518
CVE: CVE-2017-16080
Published: 2018-06-07
Description: nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/519; https://nodesecurity.io/advisories/519
CVE: CVE-2017-16081
Published: 2018-06-07
Description: cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-506, CWE-200
References: https://nodesecurity.io/advisories/520; https://nodesecurity.io/advisories/520
CVE: CVE-2017-16082
Published: 2018-06-07
Description: A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability; https://nodesecurity.io/advisories/521; https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability
CVE: CVE-2017-16083
Published: 2018-06-07
Description: node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/node-simple-router; https://nodesecurity.io/advisories/352; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/node-simple-router
CVE: CVE-2017-16084
Published: 2018-06-07
Description: list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/list-n-stream; https://nodesecurity.io/advisories/344; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/list-n-stream
CVE: CVE-2017-16085
Published: 2018-06-07
Description: tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/tinyserver2; https://nodesecurity.io/advisories/371; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/tinyserver2
CVE: CVE-2017-16086
Published: 2018-06-07
Description: ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://nodesecurity.io/advisories/316; https://nodesecurity.io/advisories/316
CVE: CVE-2017-16088
Published: 2018-06-07
Description: The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-610
References: https://github.com/hacksparrow/safe-eval/issues/5; https://github.com/patriksimek/vm2/issues/59; https://nodesecurity.io/advisories/337
CVE: CVE-2017-16089
Published: 2018-06-07
Description: serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverlyr; https://nodesecurity.io/advisories/365; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverlyr
CVE: CVE-2017-16090
Published: 2018-06-07
Description: fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/fsk-server; https://nodesecurity.io/advisories/345; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/fsk-server
CVE: CVE-2017-16091
Published: 2018-06-07
Description: xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://nodesecurity.io/advisories/339; https://nodesecurity.io/advisories/339
CVE: CVE-2017-16092
Published: 2018-06-07
Description: Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/sencisho; https://nodesecurity.io/advisories/340; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/sencisho
CVE: CVE-2017-16093
Published: 2018-06-07
Description: cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/cyber-js; https://nodesecurity.io/advisories/347; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/cyber-js
CVE: CVE-2017-16094
Published: 2018-06-07
Description: iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/iter-http; https://nodesecurity.io/advisories/343; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/iter-http
CVE: CVE-2017-16095
Published: 2018-06-07
Description: serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverliujiayi1; https://nodesecurity.io/advisories/367; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverliujiayi1
CVE: CVE-2017-16096
Published: 2018-06-07
Description: serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serveryaozeyan; https://nodesecurity.io/advisories/355; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serveryaozeyan
CVE: CVE-2017-16097
Published: 2018-06-07
Description: tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http; https://nodesecurity.io/advisories/342; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http
CVE: CVE-2017-16098
Published: 2018-06-07
Description: charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/node-modules/charset/issues/10; https://nodesecurity.io/advisories/524; https://github.com/node-modules/charset/issues/10
CVE: CVE-2017-16099
Published: 2018-06-07
Description: The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/blakeembrey/no-case/issues/17; https://nodesecurity.io/advisories/529; https://github.com/blakeembrey/no-case/issues/17
CVE: CVE-2017-16100
Published: 2018-06-07
Description: dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-77
References: https://github.com/skoranga/node-dns-sync/issues/5; https://nodesecurity.io/advisories/523; https://github.com/skoranga/node-dns-sync/issues/5
CVE: CVE-2017-16101
Published: 2018-06-07
Description: serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverwg; https://nodesecurity.io/advisories/364; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverwg
CVE: CVE-2017-16102
Published: 2018-06-07
Description: serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverhuwenhui; https://nodesecurity.io/advisories/366; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverhuwenhui
CVE: CVE-2017-16103
Published: 2018-06-07
Description: serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serveryztyzt; https://nodesecurity.io/advisories/354; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serveryztyzt
CVE: CVE-2017-16104
Published: 2018-06-07
Description: citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/citypredict.whauwiller; https://nodesecurity.io/advisories/370; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/citypredict.whauwiller
CVE: CVE-2017-16105
Published: 2018-06-07
Description: serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverwzl; https://nodesecurity.io/advisories/363; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/serverwzl
CVE: CVE-2017-16106
Published: 2018-06-07
Description: tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/tmock; https://nodesecurity.io/advisories/375; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/tmock
CVE: CVE-2017-16107
Published: 2018-06-07
Description: pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/pooledwebsocket; https://nodesecurity.io/advisories/341; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/pooledwebsocket
CVE: CVE-2017-16108
Published: 2018-06-07
Description: gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/static-html-server; https://nodesecurity.io/advisories/377; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/static-html-server
CVE: CVE-2017-16109
Published: 2018-06-07
Description: easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Access is constrained, however, to supported file types. Requesting a file such as /etc/passwd returns a "not supported" error.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/easyquick; https://nodesecurity.io/advisories/373; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/easyquick
CVE: CVE-2017-16110
Published: 2018-06-07
Description: weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/weather.swlyons; https://nodesecurity.io/advisories/379; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/weather.swlyons
CVE: CVE-2017-16111
Published: 2018-06-07
Description: The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://nodesecurity.io/advisories/530; https://nodesecurity.io/advisories/530
CVE: CVE-2017-16113
Published: 2018-06-07
Description: The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://github.com/get/parsejson/issues/4; https://nodesecurity.io/advisories/528; https://github.com/get/parsejson/issues/4
CVE: CVE-2017-16114
Published: 2018-06-07
Description: The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/chjj/marked/issues/937; https://nodesecurity.io/advisories/531; https://github.com/chjj/marked/issues/937
CVE: CVE-2017-16115
Published: 2018-06-07
Description: The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/indexzero/TimeSpan.js/issues/10; https://nodesecurity.io/advisories/533; https://github.com/indexzero/TimeSpan.js/issues/10
CVE: CVE-2017-16116
Published: 2018-06-07
Description: The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/jprichardson/string.js/issues/212; https://nodesecurity.io/advisories/536; https://github.com/jprichardson/string.js/issues/212
CVE: CVE-2017-16117
Published: 2018-06-07
Description: slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/dodo/node-slug/issues/82; https://nodesecurity.io/advisories/537; https://github.com/dodo/node-slug/issues/82
CVE: CVE-2017-16118
Published: 2018-06-07
Description: The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/104427; https://nodesecurity.io/advisories/527; http://www.securityfocus.com/bid/104427
CVE: CVE-2017-16119
Published: 2018-06-07
Description: Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://nodesecurity.io/advisories/526; https://nodesecurity.io/advisories/526
CVE: CVE-2017-16120
Published: 2018-06-07
Description: liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/liyujing; https://nodesecurity.io/advisories/387; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/liyujing
CVE: CVE-2017-16121
Published: 2018-06-07
Description: datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/datachannel-client; https://nodesecurity.io/advisories/391; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/datachannel-client
CVE: CVE-2017-16122
Published: 2018-06-07
Description: cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/cuciuci; https://nodesecurity.io/advisories/381; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/cuciuci
CVE: CVE-2017-16123
Published: 2018-06-07
Description: welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/pooledwebsocket; https://nodesecurity.io/advisories/388; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/pooledwebsocket
CVE: CVE-2017-16124
Published: 2018-06-07
Description: node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/node-server-forfront; https://nodesecurity.io/advisories/382; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/node-server-forfront
CVE: CVE-2017-16125
Published: 2018-06-07
Description: rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/rtcmulticonnection-client; https://nodesecurity.io/advisories/385; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/rtcmulticonnection-client
CVE: CVE-2017-16126
Published: 2018-06-07
Description: The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked (test, require, pre-install)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://nodesecurity.io/advisories/483; https://nodesecurity.io/advisories/483