stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2017-16000 (severity: HIGH, weakness: CWE-89)
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
CVE-2017-16001 (severity: HIGH, weakness: CWE-362)
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
CVE-2017-16003 (severity: HIGH, weakness: CWE-311)
windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2017-16005 (severity: HIGH, weakness: CWE-20)
Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.
CVE-2017-16006 (severity: MEDIUM, weakness: CWE-79)
Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.
CVE-2017-16007 (severity: MEDIUM, weakness: CWE-200)
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
CVE-2017-16008 (severity: MEDIUM, weakness: CWE-79)
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.
CVE-2017-16009 (severity: MEDIUM, weakness: CWE-79)
ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.
CVE-2017-1601 (severity: CRITICAL, weakness: CWE-521)
IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624.
CVE-2017-16010 (severity: MEDIUM, weakness: CWE-79)
i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later.
CVE-2017-16013 (severity: HIGH, weakness: CWE-400)
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
CVE-2017-16014 (severity: HIGH, weakness: CWE-703)
Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.
CVE-2017-16015 (severity: MEDIUM, weakness: CWE-80)
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
CVE-2017-16016 (severity: MEDIUM, weakness: CWE-79)
Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
CVE-2017-16017 (severity: MEDIUM, weakness: CWE-79)
sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.
CVE-2017-16018 (severity: MEDIUM, weakness: CWE-79)
Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.
CVE-2017-16019 (severity: MEDIUM, weakness: CWE-79)
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
CVE-2017-1602 (severity: MEDIUM, weakness: CWE-552)
IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.
CVE-2017-16020 (severity: CRITICAL, weakness: CWE-94)
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
CVE-2017-16021 (severity: MEDIUM, weakness: CWE-400)
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.
CVE-2017-16022 (severity: MEDIUM, weakness: CWE-79)
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
CVE-2017-16023 (severity: HIGH, weakness: CWE-400)
Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.
CVE-2017-16024 (severity: MEDIUM, weakness: CWE-377)
The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
CVE-2017-16025 (severity: MEDIUM, weakness: CWE-400)
Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
CVE-2017-16026 (severity: MEDIUM, weakness: CWE-201)
Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
CVE-2017-16028 (severity: MEDIUM, weakness: CWE-330)
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
CVE-2017-16029 (severity: HIGH, weakness: CWE-22)
hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests.
CVE-2017-16030 (severity: HIGH, weakness: CWE-400)
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
CVE-2017-16031 (severity: HIGH, weakness: CWE-330)
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
CVE-2017-16035 (severity: HIGH, weakness: CWE-311)
The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
CVE-2017-16036 (severity: HIGH, weakness: CWE-22)
`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-16037 (severity: HIGH, weakness: CWE-22)
`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.
CVE-2017-16038 (severity: HIGH, weakness: CWE-22)
`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.
CVE-2017-16039 (severity: HIGH, weakness: CWE-22)
`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-1604 (severity: MEDIUM, weakness: CWE-79)
IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.
CVE-2017-16040 (severity: HIGH, weakness: CWE-311)
gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2017-16041 (severity: MEDIUM, weakness: CWE-311)
ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.
CVE-2017-16042 (severity: CRITICAL, weakness: CWE-94)
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
CVE-2017-16043 (severity: MEDIUM, weakness: CWE-80)
Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
CVE-2017-16044 (severity: HIGH, weakness: CWE-506)
`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16045 (severity: HIGH, weakness: CWE-506)
`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16046 (severity: HIGH, weakness: CWE-506)
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16047 (severity: HIGH, weakness: CWE-506)
mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16048 (severity: HIGH, weakness: CWE-506)
`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16049 (severity: HIGH, weakness: CWE-506)
`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16050 (severity: HIGH, weakness: CWE-506)
`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16051 (severity: HIGH, weakness: CWE-506)
`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16052 (severity: HIGH, weakness: CWE-506)
`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16053 (severity: HIGH, weakness: CWE-506)
`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16054 (severity: HIGH, weakness: CWE-506)
`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16055 (severity: HIGH, weakness: CWE-506)
`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16056 (severity: HIGH, weakness: CWE-506)
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16057 (severity: HIGH, weakness: CWE-506)
nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16058 (severity: HIGH, weakness: CWE-506)
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16059 (severity: HIGH, weakness: CWE-506)
mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-1606 (severity: HIGH, weakness: CWE-89)
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 132926.
CVE-2017-16060 (severity: HIGH, weakness: CWE-506)
babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16061 (severity: HIGH, weakness: CWE-506)
tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16062 (severity: HIGH, weakness: CWE-506)
node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16063 (severity: HIGH, weakness: CWE-506)
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16064 (severity: HIGH, weakness: CWE-506)
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16065 (severity: HIGH, weakness: CWE-506)
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16066 (severity: HIGH, weakness: CWE-506)
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16067 (severity: HIGH, weakness: CWE-506)
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16068 (severity: HIGH, weakness: CWE-506)
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16069 (severity: HIGH, weakness: CWE-506)
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-1607 (severity: MEDIUM, weakness: CWE-79)
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132927.
CVE-2017-16070 (severity: HIGH, weakness: CWE-506)
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16071 (severity: HIGH, weakness: CWE-506)
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16072 (severity: HIGH, weakness: CWE-506)
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16073 (severity: HIGH, weakness: CWE-506)
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16074 (severity: HIGH, weakness: CWE-506)
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16075 (severity: HIGH, weakness: CWE-506)
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16076 (severity: HIGH, weakness: CWE-506)
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16077 (severity: HIGH, weakness: CWE-506)
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16078 (severity: HIGH, weakness: CWE-506)
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16079 (severity: HIGH, weakness: CWE-506)
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-1608 (severity: MEDIUM, weakness: CWE-79)
IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132928.
CVE-2017-16080 (severity: HIGH, weakness: CWE-506)
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16081 (severity: HIGH, weakness: CWE-506)
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16082 (severity: CRITICAL, weakness: CWE-94)
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
CVE-2017-16083 (severity: HIGH, weakness: CWE-22)
node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16084 (severity: HIGH, weakness: CWE-22)
list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-16085 (severity: HIGH, weakness: CWE-22)
tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16086 (severity: HIGH, weakness: CWE-400)
ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.
CVE-2017-16088 (severity: CRITICAL, weakness: CWE-610)
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
CVE-2017-16089 (severity: HIGH, weakness: CWE-22)
serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-1609 (severity: MEDIUM, weakness: CWE-79)
IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132929.
CVE-2017-16090 (severity: HIGH, weakness: CWE-22)
fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-16091 (severity: HIGH, weakness: CWE-22)
xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16092 (severity: HIGH, weakness: CWE-22)
Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16093 (severity: HIGH, weakness: CWE-22)
cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-16094 (severity: HIGH, weakness: CWE-22)
iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVE-2017-16095 (severity: HIGH, weakness: CWE-22)
serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16096 (severity: HIGH, weakness: CWE-22)
serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
CVE-2017-16097 (severity: HIGH, weakness: CWE-22)
tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.