rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-10481 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, if WLAN FW receives the WMI_STA_SMPS_PARAM_CMDID ioctl in not-associated state, when the virtual channel handle is not assigned, the code doesn't check for NULL virtual channel handle, so an assert occurs.
Problem types: description: Reachable Assertion in WLAN.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10482 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, while processing downlink information, an assert can be reached.
Problem types: description: Reachable Assertion in LTE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10483 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, improper input validation while processing SCM Command can lead to unauthorized memory access.
Problem types: description: Improper Input Validation in CORE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10484 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, if a RPMB listener is registered with a very small buffer size, the calculation of the maximum transfer size for read and write operations may underflow, resulting in buffer overflow.
Problem types: description: Integer overflow to buffer overflow in RPMB
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10485 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, and SDX20, lack of proper bounds checking may lead to a buffer overflow.
Problem types: description: Buffer overflow vulnerability in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10486 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, so if the buffer parameter is non-NULL terminated in Diag F3 APIs, a buffer overread occurs.
Problem types: description: Buffer Over-Read in Debugtools.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10487 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, in a QuRT API function, an untrusted pointer dereference can occur.
Problem types: description: Untrusted Pointer Dereference in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10489 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, lack of address argument validation in qsee_get_tz_app_name() may lead to an untrusted pointer dereference.
Problem types: description: Untrusted pointer dereference in QTEE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10490 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, if a negative value is passed as argument "max" to qurt_qdi_state_local_new_handle_from_obj, an buffer overflow occurs, due to typecasting the signed integer to unsigned.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10491 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, an integer overflow leading to buffer overflow can occur in a QuRT API function.
Problem types: description: Integer Overflow to Buffer Overflow in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10492 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper ciphersuite validation leads SecSSL accept an unadvertised ciphersuite.
Problem types: description: Improper Input Validation in MODEM
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10493 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, NPA routines on the rootPD that handle resource requests remoted over QDI may not validate pointers passed from user space which may result in guest OS memory corruption.
Problem types: description: Untrusted pointer dereference in NPA routines over QDI
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10494 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer overflow may lead to buffer overflows in IPC router Root-PD driver.
Problem types: description: Integer Overflow to Buffer Overflow vulnerability in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10495 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, made changes to map the scan type value to an index value that is in range.
Problem types: description: Improper Validation of Array Index in WLAN.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10496 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 210/SD 212/SD 205, SD 410/12, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, A NULL pointer dereference can occur during an SSL handshake.
Problem types: description: NULL Pointer Dereference in Modem
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10497 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper CFG allocation can cause heap leak.
Problem types: description: Reachable Assertion in MODEM
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10498 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, stopping of the DTR prematurely causes micro kernel to be stuck. This can be triggered with a timing change injectable in RACH procedure.
Problem types: description: Premature stopping of DTR HW causes microkernel to be stuck.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10499 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, memory leak may occur in the IPSecurity module when repeating IKE-Rekey.
Problem types: description: Potential Memory leak in Modem
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10501 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9635M, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 835, improper input validation can occur while parsing an image.
Problem types: description: Improper Input Validation in Core
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear, Small Cell SoC
Published: 2018-04-18T14:00:00.000Z
CVE-2016-10502 
While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identity in Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835 and SDA660.
Problem types: description: Integer Overflow or Wraparound in TrustZone.
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2018-12-10T15:00:00.000Z
CVE-2016-10503 
IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803.
Problem types: description: Other
Affected products: vendor: IBM
product: Sametime
Published: 2017-08-29T18:00:00.000Z
CVE-2016-10504 
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-30T09:00:00.000Z
CVE-2016-10505 
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-30T09:00:00.000Z
CVE-2016-10506 
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-30T09:00:00.000Z
CVE-2016-10507 
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-30T09:00:00.000Z
CVE-2016-10508 
Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T20:00:00.000Z
CVE-2016-10509 
SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T20:00:00.000Z
CVE-2016-10510 
Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-31T20:00:00.000Z
CVE-2016-10511 
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-18T21:00:00.000Z
CVE-2016-10512 
MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T18:00:00.000Z
CVE-2016-10513 
Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T20:00:00.000Z
CVE-2016-10514 
url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T20:00:00.000Z
CVE-2016-10515 
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T02:00:00.000Z
CVE-2016-10516 
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T16:00:00.000Z
CVE-2016-10517 
networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T18:00:00.000Z
CVE-2016-10518 
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
Problem types: cwe_id: CWE-201
description: Information Exposure Through Sent Data (CWE-201)
Affected products: vendor: HackerOne
product: ws node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10519 
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
Problem types: cwe_id: CWE-201
description: Information Exposure Through Sent Data (CWE-201)
Affected products: vendor: HackerOne
product: bittorrent-dht node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10520 
jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: jadedown node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10521 
jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: jshamcrest node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10522 
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: https://github.com/sferik
product: rails_admin ruby gem
Published: 2018-07-05T16:00:00.000Z
CVE-2016-10523 
MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: mqtt-packet node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10524 
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: i18n-node-angular node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10525 
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.
Problem types: description: Improper Authentication
Affected products: vendor: HackerOne
product: hapi-auth-jwt2 node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10526 
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
Problem types: cwe_id: CWE-391
description: Unchecked Error Condition (CWE-391)
Affected products: vendor: HackerOne
product: grunt-gh-pages node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10527 
The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: riot-compiler node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10528 
restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: restafary node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10529 
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: HackerOne
product: droppy node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10530 
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: HackerOne
product: airbrake node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10531 
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: marked node module
Published: 2018-05-31T20:00:00.000Z