rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-10532 
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
Problem types: description: Improper Authentication
Affected products: vendor: HackerOne
product: console-io node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10533 
express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: HackerOne
product: express-restify-mongoose node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10534 
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: HackerOne
product: electron-packager node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10535 
csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.
Problem types: cwe_id: CWE-208
description: Information Exposure Through Timing Discrepancy (CWE-208)
Affected products: vendor: HackerOne
product: csrf-lite node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10536 
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.
Problem types: cwe_id: CWE-300
description: Man-in-the-Middle (CWE-300)
Affected products: vendor: HackerOne
product: engine.io-client node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10537 
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: backbone node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10538 
The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: cli node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10539 
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: negotiator node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10540 
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: minimatch node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10541 
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
Problem types: cwe_id: CWE-78
description: OS Command Injection (CWE-78)
Affected products: vendor: HackerOne
product: shell-quote node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10542 
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: ws node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10543 
call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: HackerOne
product: call node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10544 
uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: uws node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10546 
An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: pouchdb node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10547 
Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: HackerOne
product: nunjucks node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10548 
Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: reduce-css-calc node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10549 
Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: HackerOne
product: sails node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10550 
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: sequelize node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10551 
waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: waterline-sequel node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10552 
igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: igniteui node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10553 
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: sequelize node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10554 
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: sequelize node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10555 
Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: HackerOne
product: jwt-simple node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10556 
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: HackerOne
product: sequelize node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10557 
appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: appium-chromedriver node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10558 
aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: aerospike node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10559 
selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: selenium-download node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10560 
galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: galenframework-cli node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10561 
Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: bitty node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10562 
iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: iedriver node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10563 
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: go-ipfs-dep node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10564 
apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: apk-parser node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10565 
operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: operadriver node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10566 
install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: install-nw node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10567 
product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: product-monitor node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10568 
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: geoip-lite-country node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10569 
embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: embedza node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10570 
pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: pngcrush-installer node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10571 
bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: bkjs-wand node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10572 
mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: mongodb-instance node module
Published: 2018-05-31T20:00:00.000Z
CVE-2016-10573 
baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: baryton-saxophone node module
Published: 2018-05-29T20:00:00.000Z
CVE-2016-10574 
apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: apk-parser3 node module
Published: 2018-06-01T18:00:00.000Z