Module Security Vulnerabilities

CVE-2017-16080

nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16082

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2).....

CVE-2017-16095

serverliujiayi1 is a simple http server. serverliujiayi1 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16081

cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16083

node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a specially crafted UserAgent...

CVE-2017-16088

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the...

CVE-2017-16093

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16094

iter-http is a server for static files. iter-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16084

list-n-stream is a server for static files to list and stream local videos. list-n-stream v0.0.10 or lower is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16090

fsk-server is a simple http server. fsk-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16091

xtalk helps your browser talk to nodex, a simple web framework. xtalk is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16079

smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16077

mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16078

shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16085

tinyserver2 is a webserver for static files. tinyserver2 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16092

Sencisho is a simple http server for local development. Sencisho is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16059

mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16060

babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16067

node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16063

node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16064

node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16066

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16071

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16072

nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16056

mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16057

nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16065

openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16070

nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16073

noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16058

gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16069

nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16068

ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16043

Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0...

CVE-2017-16045

jquery.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16046

mariadb was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16049

nodesqlite was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16050

sqlite.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16040

gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on...

CVE-2017-16048

node-sqlite was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16051

sqliter was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16054

nodefabric was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16042

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command...

CVE-2017-16052

node-fabric was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16044

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16055

sqlserver was a malicious module published with the intent to hijack environment variables. It has been unpublished by...

CVE-2017-16041

ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM...

CVE-2017-16039

hftp is a static http or ftp server hftp is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the...

CVE-2017-16019

GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online...