deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11132
Published: 2018-05-31
Description: In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11133
Published: 2018-05-31
Description: The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11134
Published: 2018-05-31
Description: In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11135
Published: 2018-05-31
Description: The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1321
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11136
Published: 2018-05-31
Description: The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11137
Published: 2018-05-31
Description: The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11138
Published: 2018-05-31
Description: The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.exploit-db.com/exploits/44950/; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11139
Published: 2018-05-31
Description: The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11140
Published: 2018-05-31
Description: The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11141
Published: 2018-05-31
Description: The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11142
Published: 2018-05-31
Description: The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities; https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
CVE: CVE-2018-11626
Published: 2018-05-31
Description: SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/sahaRatul/sela/issues/12; https://github.com/sahaRatul/sela/issues/12
CVE: CVE-2018-11627
Published: 2018-05-31
Description: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2019:0212; https://access.redhat.com/errata/RHSA-2019:0315; https://github.com/sinatra/sinatra/commit/12786867d6faaceaec62c7c2cb5b0e2dc074d71a
CVE: CVE-2014-10064
Published: 2018-05-31
Description: The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-399
References: https://nodesecurity.io/advisories/28; https://nodesecurity.io/advisories/28
CVE: CVE-2014-10065
Published: 2018-05-31
Description: Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://github.com/jonschlinkert/remarkable/issues/97; https://nodesecurity.io/advisories/30; https://github.com/jonschlinkert/remarkable/issues/97
CVE: CVE-2014-10066
Published: 2018-05-31
Description: Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://nodesecurity.io/advisories/9; https://nodesecurity.io/advisories/9
CVE: CVE-2015-9236
Published: 2018-05-31
Description: Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-200
References: https://github.com/hapijs/hapi/issues/2840; https://github.com/hapijs/hapi/issues/2850; https://nodesecurity.io/advisories/45
CVE: CVE-2015-9238
Published: 2018-05-31
Description: secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697, CWE-134
References: https://github.com/vdemedes/secure-compare/pull/1; https://nodesecurity.io/advisories/50; https://github.com/vdemedes/secure-compare/pull/1
CVE: CVE-2015-9239
Published: 2018-05-31
Description: ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://nodesecurity.io/advisories/51; https://nodesecurity.io/advisories/51
CVE: CVE-2016-10518
Published: 2018-05-31
Description: A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201, CWE-119
References: https://gist.github.com/c0nrad/e92005446c480707a74a; https://github.com/websockets/ws/releases/tag/1.0.1; https://nodesecurity.io/advisories/67
CVE: CVE-2016-10519
Published: 2018-05-31
Description: A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201, CWE-200
References: https://github.com/feross/bittorrent-dht/issues/87; https://nodesecurity.io/advisories/68; https://github.com/feross/bittorrent-dht/issues/87
CVE: CVE-2016-10520
Published: 2018-05-31
Description: jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://nodesecurity.io/advisories/52; https://nodesecurity.io/advisories/52
CVE: CVE-2016-10521
Published: 2018-05-31
Description: jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://nodesecurity.io/advisories/53; https://nodesecurity.io/advisories/53
CVE: CVE-2016-10523
Published: 2018-05-31
Description: MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-119
References: https://github.com/mcollina/mosca/issues/393; https://github.com/mqttjs/mqtt-packet/pull/8; https://nodesecurity.io/advisories/75
CVE: CVE-2016-10524
Published: 2018-05-31
Description: i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/oliversalzburg/i18n-node-angular/commit/877720d2d9bb90dc8233706e81ffa03f99fc9dc8; https://nodesecurity.io/advisories/80; https://github.com/oliversalzburg/i18n-node-angular/commit/877720d2d9bb90dc8233706e81ffa03f99fc9dc8
CVE: CVE-2016-10526
Published: 2018-05-31
Description: A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
CVSS Score: 8.6 (HIGH)
CWE: CWE-391, CWE-255, CWE-532
References: https://github.com/tschaub/grunt-gh-pages/pull/41; https://nodesecurity.io/advisories/85; https://github.com/tschaub/grunt-gh-pages/pull/41
CVE: CVE-2016-10527
Published: 2018-05-31
Description: The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-399
References: https://github.com/riot/compiler/issues/46; https://nodesecurity.io/advisories/86; https://github.com/riot/compiler/issues/46
CVE: CVE-2016-10528
Published: 2018-05-31
Description: restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://nodesecurity.io/advisories/89; https://nodesecurity.io/advisories/89
CVE: CVE-2016-10529
Published: 2018-05-31
Description: Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://nodesecurity.io/advisories/91; https://nodesecurity.io/advisories/91
CVE: CVE-2016-10530
Published: 2018-05-31
Description: The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200, CWE-200, CWE-310
References: https://github.com/airbrake/node-airbrake/issues/70; https://nodesecurity.io/advisories/96; https://github.com/airbrake/node-airbrake/issues/70
CVE: CVE-2016-10531
Published: 2018-05-31
Description: marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/chjj/marked/pull/592; https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523; https://nodesecurity.io/advisories/101
CVE: CVE-2016-10532
Published: 2018-05-31
Description: console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://nodesecurity.io/advisories/90; https://nodesecurity.io/advisories/90
CVE: CVE-2016-10533
Published: 2018-05-31
Description: express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/florianholzapfel/express-restify-mongoose/issues/252; https://nodesecurity.io/advisories/92; https://github.com/florianholzapfel/express-restify-mongoose/issues/252
CVE: CVE-2016-10534
Published: 2018-05-31
Description: electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/electron-userland/electron-packager/issues/333; https://nodesecurity.io/advisories/104; https://github.com/electron-userland/electron-packager/issues/333
CVE: CVE-2016-10535
Published: 2018-05-31
Description: csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208, CWE-310
References: https://github.com/isaacs/csrf-lite/pull/1; https://nodesecurity.io/advisories/94; https://github.com/isaacs/csrf-lite/pull/1
CVE: CVE-2016-10536
Published: 2018-05-31
Description: engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-300, CWE-295
References: https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1; https://nodesecurity.io/advisories/99; https://www.cigital.com/blog/node-js-socket-io/
CVE: CVE-2016-10537
Published: 2018-05-31
Description: backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008; https://nodesecurity.io/advisories/108; https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008
CVE: CVE-2016-10538
Published: 2018-05-31
Description: The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
CVSS Score: 3.5 (LOW)
CWE: CWE-22, CWE-362
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252; https://github.com/node-js-libs/cli/issues/81; https://nodesecurity.io/advisories/95
CVE: CVE-2016-10539
Published: 2018-05-31
Description: negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://nodesecurity.io/advisories/106; https://nodesecurity.io/advisories/106
CVE: CVE-2016-10540
Published: 2018-05-31
Description: Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://nodesecurity.io/advisories/118; https://nodesecurity.io/advisories/118
CVE: CVE-2016-10541
Published: 2018-05-31
Description: The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-94
References: https://github.com/advisories/GHSA-qg8p-v9q4-gh34; https://nodesecurity.io/advisories/117; https://github.com/advisories/GHSA-qg8p-v9q4-gh34
CVE: CVE-2016-10542
Published: 2018-05-31
Description: ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://github.com/nodejs/node/issues/7388; https://nodesecurity.io/advisories/120; https://github.com/nodejs/node/issues/7388
CVE: CVE-2016-10543
Published: 2018-05-31
Description: call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/hapijs/hapi/issues/3228; https://nodesecurity.io/advisories/121; https://github.com/hapijs/hapi/issues/3228