deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-16127
Published: 2018-06-07
Description: The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-509, CWE-276
References: https://nodesecurity.io/advisories/482; https://nodesecurity.io/advisories/482
CVE: CVE-2017-16128
Published: 2018-06-07
Description: The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-506, CWE-276
References: https://nodesecurity.io/advisories/481; https://nodesecurity.io/advisories/481
CVE: CVE-2017-16129
Published: 2018-06-07
Description: The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-409, CWE-400
References: https://github.com/visionmedia/superagent/issues/1259; https://nodesecurity.io/advisories/479; https://github.com/visionmedia/superagent/issues/1259
CVE: CVE-2017-16130
Published: 2018-06-07
Description: exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to those with a file extension. Files with no extension such as /etc/passwd throw an error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/exxxxxxxxxxx; https://nodesecurity.io/advisories/478; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/exxxxxxxxxxx
CVE: CVE-2017-16131
Published: 2018-06-07
Description: unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/unicorn-list; https://nodesecurity.io/advisories/477; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/unicorn-list
CVE: CVE-2017-16132
Published: 2018-06-07
Description: simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/simple-npm-registry; https://nodesecurity.io/advisories/452; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/simple-npm-registry
CVE: CVE-2017-16133
Published: 2018-06-07
Description: goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/goserv; https://nodesecurity.io/advisories/473; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/goserv
CVE: CVE-2017-16134
Published: 2018-06-07
Description: http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/http_static_simple; https://nodesecurity.io/advisories/472; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/http_static_simple
CVE: CVE-2017-16135
Published: 2018-06-07
Description: serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/serverzyy; https://nodesecurity.io/advisories/431; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/serverzyy
CVE: CVE-2017-16136
Published: 2018-06-07
Description: method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://nodesecurity.io/advisories/538; https://nodesecurity.io/advisories/538
CVE: CVE-2017-16137
Published: 2018-06-07
Description: The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/visionmedia/debug/issues/501; https://github.com/visionmedia/debug/pull/504; https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
CVE: CVE-2017-16138
Published: 2018-06-07
Description: The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/broofa/node-mime/issues/167; https://nodesecurity.io/advisories/535; https://github.com/broofa/node-mime/issues/167
CVE: CVE-2017-16139
Published: 2018-06-07
Description: jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to files with .htm and .js extensions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/jikes; https://nodesecurity.io/advisories/476; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/jikes
CVE: CVE-2017-16140
Published: 2018-06-07
Description: lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/lab6.brit95; https://nodesecurity.io/advisories/475; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/lab6.brit95
CVE: CVE-2017-16141
Published: 2018-06-07
Description: lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/lab6drewfusbyu; https://nodesecurity.io/advisories/474; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/lab6drewfusbyu
CVE: CVE-2017-16142
Published: 2018-06-07
Description: infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/infraserver; https://nodesecurity.io/advisories/471; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/infraserver
CVE: CVE-2017-16143
Published: 2018-06-07
Description: commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/commentapp.stetsonwood; https://nodesecurity.io/advisories/470; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/commentapp.stetsonwood
CVE: CVE-2017-16144
Published: 2018-06-07
Description: myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/myserver.alexcthomas18; https://nodesecurity.io/advisories/469; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/myserver.alexcthomas18
CVE: CVE-2017-16145
Published: 2018-06-07
Description: sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/sspa; https://nodesecurity.io/advisories/463; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/sspa
CVE: CVE-2017-16146
Published: 2018-06-07
Description: mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/mockserve; https://nodesecurity.io/advisories/445; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/mockserve
CVE: CVE-2017-16147
Published: 2018-06-07
Description: shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/shit-server; https://nodesecurity.io/advisories/430; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/shit-server
CVE: CVE-2017-16148
Published: 2018-06-07
Description: serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/serve46; https://nodesecurity.io/advisories/456; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/serve46
CVE: CVE-2017-16149
Published: 2018-06-07
Description: zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/zwserver; https://nodesecurity.io/advisories/372; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/zwserver
CVE: CVE-2017-16150
Published: 2018-06-07
Description: wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/wangguojing123; https://nodesecurity.io/advisories/374; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/wangguojing123
CVE: CVE-2017-16151
Published: 2018-06-07
Description: Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix; https://nodesecurity.io/advisories/539; https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix
CVE: CVE-2017-16152
Published: 2018-06-07
Description: static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/static-html-server; https://nodesecurity.io/advisories/376; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/static-html-server
CVE: CVE-2017-16154
Published: 2018-06-07
Description: earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/earlybird; https://nodesecurity.io/advisories/380; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/earlybird
CVE: CVE-2017-16155
Published: 2018-06-07
Description: fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/fast-http-cli; https://nodesecurity.io/advisories/383; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/fast-http-cli
CVE: CVE-2017-16156
Published: 2018-06-07
Description: myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/myprolyz; https://nodesecurity.io/advisories/386; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/myprolyz
CVE: CVE-2017-16157
Published: 2018-06-07
Description: censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/censorify.tanisjr; https://nodesecurity.io/advisories/392; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/censorify.tanisjr
CVE: CVE-2017-16158
Published: 2018-06-07
Description: dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http; https://nodesecurity.io/advisories/393; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/tiny-http
CVE: CVE-2017-16159
Published: 2018-06-07
Description: caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/caolilinode; https://nodesecurity.io/advisories/394; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/caolilinode
CVE: CVE-2017-16160
Published: 2018-06-07
Description: 11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/11xiaoli; https://nodesecurity.io/advisories/395; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/11xiaoli
CVE: CVE-2017-16161
Published: 2018-06-07
Description: shenliru is a simple file server. shenliru is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/shenliru; https://nodesecurity.io/advisories/389; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/shenliru
CVE: CVE-2017-16162
Published: 2018-06-07
Description: 22lixian is a simple file server. 22lixian is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/22lixian; https://nodesecurity.io/advisories/390; https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/22lixian
CVE: CVE-2017-16163
Published: 2018-06-07
Description: dylmomo is a simple file server. dylmomo is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dylmomo; https://nodesecurity.io/advisories/396; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/dylmomo
CVE: CVE-2017-16164
Published: 2018-06-07
Description: desafio is a simple web server. desafio is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url, but is limited to accessing only .html files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/desafio; https://nodesecurity.io/advisories/397; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/desafio
CVE: CVE-2017-16165
Published: 2018-06-07
Description: calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/calmquist.static-server; https://nodesecurity.io/advisories/398; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/calmquist.static-server
CVE: CVE-2017-16166
Published: 2018-06-07
Description: byucslabsix is an http server. byucslabsix is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/byucslabsix; https://nodesecurity.io/advisories/399; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/byucslabsix
CVE: CVE-2017-16167
Published: 2018-06-07
Description: yyooopack is a simple file server. yyooopack is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/yyooopack; https://nodesecurity.io/advisories/400; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/yyooopack
CVE: CVE-2017-16168
Published: 2018-06-07
Description: wffserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/wffserve; https://nodesecurity.io/advisories/407; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/wffserve
CVE: CVE-2017-16169
Published: 2018-06-07
Description: looppake is a simple http server. looppake is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/looppake; https://nodesecurity.io/advisories/412; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/looppake
CVE: CVE-2017-16170
Published: 2018-06-07
Description: liuyaserver is a static file server. liuyaserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/liuyaserver; https://nodesecurity.io/advisories/413; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/liuyaserver
CVE: CVE-2017-16171
Published: 2018-06-07
Description: hcbserver is a static file server. hcbserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/hcbserver; https://nodesecurity.io/advisories/414; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/hcbserver
CVE: CVE-2017-16172
Published: 2018-06-07
Description: section2.madisonjbrooks12 is a simple web server. section2.madisonjbrooks12 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/section2.madisonjbrooks12; https://nodesecurity.io/advisories/468; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/section2.madisonjbrooks12
CVE: CVE-2017-16173
Published: 2018-06-07
Description: utahcityfinder constructs lists of Utah cities with a certain prefix. utahcityfinder is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/utahcityfinder; https://nodesecurity.io/advisories/467; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/utahcityfinder
CVE: CVE-2017-16174
Published: 2018-06-07
Description: whispercast is a file server. whispercast is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/whispercast; https://nodesecurity.io/advisories/466; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/whispercast
CVE: CVE-2017-16175
Published: 2018-06-07
Description: ewgaddis.lab6 is a file server. ewgaddis.lab6 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/ewgaddis.lab6; https://nodesecurity.io/advisories/465; https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/ewgaddis.lab6