413 matches found
CVE-2019-10787
im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization...
Cross-Site Scripting (XSS)
url-parse is vulnerable to cross-site scripting XSS. The vulnerability exists as the unsanitized value of address in index.js could be used to bypass validation checks when used in the browser...
CVE-2019-10776
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
CVE-2019-10776
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
Command injection
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
CVE-2019-10776
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
CVE-2019-10776
CVE-2019-10776 affects the package git-diff-apply prior to v0.22.2. The vulnerability stems from unvalidated input in index.js where a run() command is constructed from a user-controlled remoteUrl, enabling OS command injection. Impact could include remote code execution if untrusted input is sup...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
CVE-2019-20149 pertains to kind-of v6.0.2 where ctorName in index.js can be overwritten via a crafted payload to alter type-detection results by exploiting a conflicting name (e.g., 'constructor': {'name':'Symbol'}). The IBM QRadar Use Case Manager bulletin (connected doc) aggregates this CVE amo...
Memory Leaks
socket.io-adapter is vulnerable to memory leak.This occurs because the function Adapter.prototype.del in index.js leaves a room without properly validating the closure of a socket, allowing an attacker to trigger memory leaks by sending the leave signals...
Cross-Site Scripting (XSS)
sanitize-html is vulnerable to cross-site scripting XSS. The opentag function in index.js fails to sanitize HTML attributes when sanitizing HTML tags that have been modified using a custom tag transformation. If an application uses custom tag transformations, and places user input in an HTML...
GHSA-72FV-QGJ6-2W2P Cross-site Scripting in NodeBB
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...
Unspecified Vulnerability in Total.js Platform
Total.js Platform is a suite of JavaScript Web platforms. The platform includes Total.js framework, Total.js apps, SQL Agent and NoSQL embedded DB. A security vulnerability exists in the index.js file in versions of Total.js Platform prior to 3.2.3. No details of the vulnerability are provided at...
Path Traversal
total.js is vulnerable to path traversal attacks. The vulnerability exists in index.js where req.url is insufficiently sanitized, allowing path traversal attacks...
CVE-2019-8903
index.js in Total.js Platform before 3.2.3 allows path traversal...
CVE-2019-8903
index.js in Total.js Platform before 3.2.3 allows path traversal...
Denial Of Service (DoS)
url-relative is vulnerable to denial of service DoS. The library does not check the to and from values in the function urlRelative in index.js, preventing the function from returning when a user provides the same values for to and from...