rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-16025 
Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: nes node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16026 
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Problem types: cwe_id: CWE-201
description: Information Exposure Through Sent Data (CWE-201)
Affected products: vendor: HackerOne
product: request node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16028 
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
Problem types: cwe_id: CWE-330
description: Use of Insufficiently Random Values (CWE-330)
Affected products: vendor: HackerOne
product: react-native-meteor-oauth node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16029 
hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: hostr node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16030 
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: useragent node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16031 
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
Problem types: description: Account Hijacking
Affected products: vendor: HackerOne
product: socket.io node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16035 
The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: hubl-server node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16036 
`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: badjs-sourcemap-server node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16037 
`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: gomeplus-h5-proxy node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16038 
`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.
Problem types: description: Account Hijacking
Affected products: vendor: HackerOne
product: f2e-server node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16039 
`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: hftp node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16040 
gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: gfe-sass node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16041 
ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.
Problem types: cwe_id: CWE-311
description: Missing Encryption of Sensitive Data (CWE-311)
Affected products: vendor: HackerOne
product: ikst node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16042 
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: growl node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16043 
Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
Problem types: cwe_id: CWE-80
description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
Affected products: vendor: HackerOne
product: shout node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16044 
`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: d3.js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16045 
`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: jquery.js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16046 
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: mariadb node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16047 
mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: mysqljs node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16048 
`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-sqlite node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16049 
`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodesqlite node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16050 
`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: sqlite.js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16051 
`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: sqliter node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16052 
`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-fabric node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16053 
`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: fabric-js node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16054 
`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodefabric node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16055 
`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: sqlserver node module
Published: 2018-06-04T19:00:00.000Z
CVE-2017-16056 
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: mssql.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16057 
nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodemssql node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16058 
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: gruntcli node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16059 
mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: mssql-node node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16060 
babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: babelcli node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16061 
tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: tkinter node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16062 
node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-tkinter node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16063 
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-opensl node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16064 
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-openssl node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16065 
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: openssl.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16066 
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: opencv.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16067 
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: node-opencv node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16068 
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: ffmepg node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16069 
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodeffmpeg node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16070 
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodecaffe node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16071 
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodemailer-js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16072 
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodemailer.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16073 
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: noderequest node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16074 
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: crossenv node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16075 
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: http-proxy.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16076 
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: proxy.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16077 
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: mongose node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16078 
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: shadowsock node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16079 
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: smb node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16080 
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: nodesass node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16081 
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: cross-env.js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16082 
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: pg node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16083 
node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: node-simple-router node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16084 
list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: list-n-stream node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16085 
tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: tinyserver2 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16086 
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: ua-parser node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16088 
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
Problem types: cwe_id: CWE-610
description: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
Affected products: vendor: HackerOne
product: safe-eval node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16089 
serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverlyr node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16090 
fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: fsk-server node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16091 
xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: xtalk node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16092 
Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: sencisho node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16093 
cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: cyber-js node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16094 
iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: iter-http node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16095 
serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverliujiayi1 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16096 
serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serveryaozeyan node module
Published: 2018-06-07T02:00:00.000Z