CVE-2026-82417: Uncaught Exception

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2026-33979: Permissive List of Allowed Inputs

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are...

MAL-2022-2924 Malicious code in express-4.x-passport-snapchat-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0ca6535a564c08a2ffa5c45fb5ec728ccbdb49e6b49c6dcea0320b08f6bae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Directory traversal

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16184

Summary (CVE-2017-16184): The issue affects the Node.js/Express-based sample app scott-blanch-weather-app , where a directory traversal vulnerability exists in path handling that allows access to the filesystem by using sequences like '../../..'. The root cause is improper handling of user-suppli...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2000-0415

Outlook Express 4.x is affected by a buffer overflow triggered by mail/news messages with a .jpg or .bmp attachment having a long filename. The vulnerability is reported to allow denial of service. The connected documents corroborate the issue as described for Outlook Express 4.x; no specific exp...

Overflow in Outlook Express 4.* - too long filenames with graphic format extension

==== APPLICATION AFFECTED Outlook Express 4. 5. is not affected ==== DESCRIPTION All attached graphic files are automatically shown in the Outlook Express while viewing the e-mail. The problem is that long filenames with .jpg .bmp extension makes overflow if filename lenght is longer then 256...