yahoo-inc/cve-impacts huggingface dataset:
CVE-2017-15943: The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities.
Key phrases: obtain sensitive information, conduct server-side request forgery (SSRF, vulnerability objects, vectors related to parsing of external entities, server side request forgery
CVE-2017-15944: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
Key phrases: execute arbitrary code, execute arbitrary code via vectors involving the management, management interface
CVE-2017-15945: The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.
Key phrases: gain privileges, gain privileges by leveraging access to the mysql
CVE-2017-15946: In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.
Key phrases: sql injection
CVE-2017-15947: Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp.
Key phrases: xss
CVE-2017-15948: Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.
Key phrases: unrestricted file upload (with resultant XSS), xss
CVE-2017-15949: Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php.
Key phrases: admin/adminuseredit.php or the log_id parameter to, sql injection
CVE-2017-1595: IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132549.
Key phrases: obtain highly sensitive information, obtain highly sensitive information via unspecified vectors
CVE-2017-15950: Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode.
Key phrases: buffer overflow, arbitrary code, arbitrary code execution
CVE-2017-15951: The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.
Key phrases: cause a denial of service or possibly have, race condition, unspecified other impact, unspecified impact
CVE-2017-15953: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.
Key phrases: heap-based buffer overflow, crash, heap based buffer overflow
CVE-2017-15954: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.
Key phrases: heap-based buffer overflow, invalid free, crash, heap based buffer overflow
CVE-2017-15955: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.
Key phrases: access violation near null on destination operand, crash
CVE-2017-15956: ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
Key phrases: allows Arbitrary File Download, download.php, arbitrary file download
CVE-2017-15957: my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
Key phrases: upload an arbitrary file
CVE-2017-15958: D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
Key phrases: admin/loginform.php, sql injection
CVE-2017-15959: Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.
Key phrases: a /download URI, sql injection
CVE-2017-1596: IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force ID: 132550.
Key phrases: obtain highly sensitive information, obtain highly sensitive information via unspecified vectors
CVE-2017-15960: Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
Key phrases: author.php or category.php, sql injection
CVE-2017-15961: iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
Key phrases: index.php, sql injection
CVE-2017-15962: iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
Key phrases: allows Arbitrary File Upload, Arbitrary File Upload via user/profile, arbitrary file upload
CVE-2017-15963: iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter.
Key phrases: SQL Injection via the browse-scategory.php sc parameter or, sql injection
CVE-2017-15964: Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
Key phrases: a /job-details URI, sql injection
CVE-2017-15965: The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.
Key phrases: SQL Injection via the id parameter in, sql injection
CVE-2017-15966: The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.
Key phrases: index.php, sql injection
CVE-2017-15967: Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to admin/template.
Key phrases: admin/users in a sort=login, sql injection
CVE-2017-15968: MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
Key phrases: SQL Injection via the phpsqlsearch_genxml.php subcategory parameter, sql injection
CVE-2017-15969: PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category.
Key phrases: search/tag, sql injection
CVE-2017-1597: IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610.
CVE-2017-15970: PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
Key phrases: index.php in a page=news action, sql injection
CVE-2017-15971: Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15972.
Key phrases: CVE-2017-15972, sql injection
CVE-2017-15972: SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15971.
Key phrases: CVE-2017-15971, sql injection
CVE-2017-15973: Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
Key phrases: admin/members_view.php, sql injection
CVE-2017-15974: tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
Key phrases: Bypass via 'or 1=1 or ''=, Authentication Bypass, login.php, sql injection, authentication bypass
CVE-2017-15975: Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
Key phrases: add_to_cart.php, sql injection
CVE-2017-15976: ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.
Key phrases: SQL Injection via the admin/editadgroup.php groupid, sql injection
CVE-2017-15977: Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
Key phrases: SQL Injection via the username parameter, sql injection
CVE-2017-15978: AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
Key phrases: SQL Injection via the office_admin/ id parameter, sql injection
CVE-2017-15979: Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
Key phrases: SQL Injection via the photo parameter, sql injection
CVE-2017-1598: IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 132611.
Key phrases: decrypt highly sensitive information, weaker than expected cryptographic algorithms
CVE-2017-15980: US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.
Key phrases: SQL Injection via the state parameter, sql injection
CVE-2017-15981: Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Key phrases: admin/admin_process.php for form editing, sql injection
CVE-2017-15982: Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Key phrases: admin/admin_process.php for form editing, sql injection
CVE-2017-15983: MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.
Key phrases: admin/admin_process.php for form editing, sql injection
CVE-2017-15984: Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.
Key phrases: index.php, sql injection
CVE-2017-15985: Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.
Key phrases: SQL Injection via the product_view1.php pid or i, sql injection
CVE-2017-15986: CPA Lead Reward Script allows SQL Injection via the username parameter.
Key phrases: SQL Injection via the username parameter, sql injection
CVE-2017-15987: Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.
Key phrases: SQL Injection via the rate.php value parameter or, sql injection
CVE-2017-15988: Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.
Key phrases: SQL Injection via the index.php nice_theme parameter, sql injection
CVE-2017-15989: Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.
Key phrases: SQL Injection via the resources.php sort parameter in, sql injection
CVE-2017-15990: Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.
Key phrases: allows Arbitrary File Upload, Arbitrary File Upload via dashboard/edit_myaccountdetail/., arbitrary file upload
CVE-2017-15991: Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.
Key phrases: SQL Injection in searchCommercial.php via the property_type, sql injection
CVE-2017-15992: Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.
Key phrases: status_list.php, sql injection
CVE-2017-15993: Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.
Key phrases: SQL Injection via the restaurant-menu.php resid parameter, sql injection
CVE-2017-15994: rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.
Key phrases: bypass intended access restrictions
CVE-2017-15996: elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.
Key phrases: denial of service (excessive memory allocation), cause a denial of service (excessive memory, unspecified other impact, buffer overflow on fuzzed archive header, uninitialized variable, improper conditional jump, unspecified impact
CVE-2017-15997: In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file.
Key phrases: gain access
CVE-2017-15998: In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.
Key phrases: obtain cleartext information
CVE-2017-15999: In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.
Key phrases: cleartext
CVE-2017-1600: IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132613.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2017-16000: SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the graph parameter, sql injection, arbitrary sql commands
CVE-2017-16001: In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.
Key phrases: root privileges
CVE-2017-16003: windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Key phrases: mitm, remote code execution (rce)
CVE-2017-16005: Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.
Key phrases: header forgery
CVE-2017-16006: Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.
Key phrases: the use of `data:` URIs
CVE-2017-16007: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
Key phrases: recover the private secret key when JWE with, invalid curve
CVE-2017-16008: i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.
Key phrases: untrusted user input
CVE-2017-16009: ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in combination with ag-grid.
Key phrases: cross-site scripting (xss)
CVE-2017-1601: IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132624.
CVE-2017-16010: i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later.
Key phrases: cross-site scripting
CVE-2017-16013: hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Key phrases: crash, hang
CVE-2017-16014: Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causing a denial of service.
Key phrases: denial of service, crash
CVE-2017-16015: Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
Key phrases: cross site scripting, cross-site scripting
CVE-2017-16016: Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
Key phrases: cross site scripting (xss)
CVE-2017-16017: sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2017-16018: Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers.
Key phrases: url encoded script tags, non-existent url
CVE-2017-16019: GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
Key phrases: cross-site-scripting (xss)
CVE-2017-1602: IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.
Key phrases: access settings that they should not be able
CVE-2017-16020: Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Key phrases: execute arbitrary commands, execute arbitrary commands via the collection name
CVE-2017-16021: uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.
Key phrases: redos, hang
CVE-2017-16022: Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
CVE-2017-16023: Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values, which can be used to create a denial of service attack.
Key phrases: unescaped separator values, denial of service
CVE-2017-16024: The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Key phrases: obtain confidential information, obtain confidential information from the buffer/tmp, read access
CVE-2017-16025: Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Key phrases: denial of service
CVE-2017-16026: Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Key phrases: non-zero memory
CVE-2017-16028: react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
Key phrases: non-cryptographically strong rng
CVE-2017-16029: hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that allows an attacker to read files outside the current directory by sending `../` in the url path for GET requests.
Key phrases: read files outside the current directory by sending, directory traversal
CVE-2017-16030: Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
CVE-2017-16031: Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
Key phrases: gain access, predictable, sensitive information, obtain sensitive information
CVE-2017-16035: The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It appears in the code that these files are downloaded over HTTPS however the api.hubapi.com endpoint redirects to a HTTP url. Because of this behavior an attacker with the ability to man-in-the-middle a developer or system performing a package installation could compromise the integrity of the installation.
Key phrases: man-in-the-middle, man in the middle, integrity
CVE-2017-16036: `badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16037: `gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in the URL.
Key phrases: access any file in the system by placing, directory traversal
CVE-2017-16038: `f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.
Key phrases: directory traversal
CVE-2017-16039: `hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-1604: IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132851.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2017-16040: gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Key phrases: mitm, remote code execution (rce)
CVE-2017-16041: ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.
Key phrases: mitm
CVE-2017-16042: Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
Key phrases: for arbitrary command execution, arbitrary commands
CVE-2017-16043: Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
Key phrases: unescaped, html scripts
CVE-2017-16044: `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16045: `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16046: `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16047: mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16048: `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16049: `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16050: `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16051: `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16052: `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16053: `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16054: `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16055: `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16056: mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16057: nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16058: gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16059: mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-1606: IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 132926.
Key phrases: view, sql injection
CVE-2017-16060: babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16061: tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16062: node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16063: node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16064: node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16065: openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16066: opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16067: node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16068: ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16069: nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-1607: IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132927.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2017-16070: nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16071: nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16072: nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16073: noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16074: crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: hijack
CVE-2017-16075: http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16076: proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16077: mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16078: shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16079: smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-1608: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132928.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2017-16080: nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: environment variables, hijack
CVE-2017-16081: cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Key phrases: hijack
CVE-2017-16082: A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
Key phrases: remote code execution
CVE-2017-16083: node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16084: list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16085: tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16086: ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent header.
Key phrases:  ReDoS (Regular Expression Denial of Service), redos
CVE-2017-16088: The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
Key phrases: un-sanitized user input
CVE-2017-16089: serverlyr is a simple http server. serverlyr is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-1609: IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132929.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2017-16090: fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16091: xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16092: Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16093: cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16094: iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16095: serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16096: serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16097: tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16098: charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Key phrases: regular expression denial of service, slow down
CVE-2017-16099: The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
Key phrases: regular expression denial of service, denial of service condition
CVE-2017-16100: dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Key phrases: untrusted user input, command injection
CVE-2017-16101: serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16102: serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16103: serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16104: citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16105: serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Key phrases: directory traversal
CVE-2017-16106: tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16107: pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16108: gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16109: easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Access is constrained, however, to supported file types. Requesting a file such as /etc/passwd returns a "not supported" error.
Key phrases: directory traversal
CVE-2017-16110: weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16111: The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.
Key phrases: regular expression denial of service
CVE-2017-16113: The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.
Key phrases: regular expression denial of service
CVE-2017-16114: The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
Key phrases: marked module, regular expression denial of service, characters
CVE-2017-16115: The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Key phrases: regular expression denial of service
CVE-2017-16116: The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.
Key phrases: regular expression denial of service
CVE-2017-16117: slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.
Key phrases: regular expression denial of service, characters
CVE-2017-16118: The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Key phrases: regular expression denial of service
CVE-2017-16119: Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Key phrases: regular expression denial of service
CVE-2017-1612: IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953.
Key phrases: service trace module, untrusted code
CVE-2017-16120: liyujing is a static file server. liyujing is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16121: datachannel-client is a signaling implementation for DataChannel.js. datachannel-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16122: cuciuci is a simple fileserver. cuciuci is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16123: welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16124: node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16125: rtcmulticonnection-client is a signaling implementation for RTCMultiConnection.js, a multi-session manager. rtcmulticonnection-client is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Key phrases: directory traversal
CVE-2017-16126: The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked (test, require, pre-install)
CVE-2017-16127: The module pandora-doomsday infects other modules. It's since been unpublished from the registry.
CVE-2017-16128: The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.
CVE-2017-16129: The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.
Key phrases: zip bomb, memory consumption, weakness, dos