rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-16097 
tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: tiny-http node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16098 
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: charset node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16099 
The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: no-case node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16100 
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: dns-sync node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16101 
serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverwg node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16102 
serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverhuwenhui node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16103 
serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serveryztyzt node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16104 
citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: citypredict.whauwiller node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16105 
serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverwzl node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16106 
tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: tmock node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16107 
pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: pooledwebsocket node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16108 
gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: gaoxiaotingtingting node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16109 
easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Access is constrained, however, to supported file types. Requesting a file such as /etc/passwd returns a "not supported" error.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: easyquick node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16110 
weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: weather.swlyons node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16111 
The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: content node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16113 
The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: parsejson node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16114 
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: marked node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16115 
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: timespan node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16116 
The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: string node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16117 
slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: slug node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16118 
The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: forwarded node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16119 
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: fresh node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16120 
liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: liyujing node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16121 
datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: datachannel-client node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16122 
cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: cuciuci node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16123 
welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: welcomyzt node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16124 
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: node-server-forfront node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16125 
rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: rtcmulticonnection-client node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16126 
The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked (test, require, pre-install)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16127 
The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
Problem types: cwe_id: CWE-509
description: Replicating Malicious Code (Virus or Worm) (CWE-509)
Affected products: vendor: HackerOne
product: pandora-doomsday node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16128 
The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
Problem types: cwe_id: CWE-506
description: Embedded Malicious Code (CWE-506)
Affected products: vendor: HackerOne
product: npm-script-demo node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16129 
The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Problem types: cwe_id: CWE-409
description: Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
Affected products: vendor: HackerOne
product: superagent node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16130 
exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to those with a file extension. Files with no extension such as /etc/passwd throw an error.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: exxxxxxxxxxx node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16131 
unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: unicorn-list node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16132 
simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: simple-npm-registry node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16133 
goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: goserv node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16134 
http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: http_static_simple node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16135 
serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serverzyy node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16136 
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: method-override node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16137 
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: debug node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16138 
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: HackerOne
product: mime node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16139 
jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to files with .htm and .js extensions.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: jikes node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16140 
lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: lab6.brit95 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16141 
lab6drewfusbyu is an http server. lab6drewfusbyu is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: lab6drewfusbyu node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16142 
infraserver is a RESTful server. infraserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: infraserver node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16143 
commentapp.stetsonwood is an http server. commentapp.stetsonwood is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: commentapp.stetsonwood node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16144 
myserver.alexcthomas18 is a file server. myserver.alexcthomas18 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: myserver.alexcthomas18 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16145 
sspa is a server dedicated to single-page apps. sspa is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: sspa node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16146 
mockserve is a file server. mockserve is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: mockserve node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16147 
shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: shit-server node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16148 
serve46 is a static file server. serve46 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: serve46 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16149 
zwserver is a weather web server. zwserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: zwserver node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16150 
wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: wangguojing123 node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16151 
Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: HackerOne
product: electron node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16152 
static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: static-html-server node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16153 
gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: gaoxuyan node module
Published: 2018-05-29T20:00:00.000Z
CVE-2017-16154 
earlybird is a web server module for early development. earlybird is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: earlybird node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16155 
fast-http-cli is the command line interface for fast-http, a simple web server. fast-http-cli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: fast-http-cli node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16156 
myprolyz is a static file server. myprolyz is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: myprolyz node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16157 
censorify.tanisjr is a simple web server and API RESTful service. censorify.tanisjr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: censorify.tanisjr node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16158 
dcserver is a static file server. dcserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: dcserver node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16159 
caolilinode is a simple file server. caolilinode is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: caolilinode node module
Published: 2018-06-07T02:00:00.000Z
CVE-2017-16160 
11xiaoli is a simple file server. 11xiaoli is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: HackerOne
product: 11xiaoli node module
Published: 2018-06-07T02:00:00.000Z