Node.js Denial of Service Vulnerability (CNVD-2018-11809)

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

UBUNTU-CVE-2018-7167

Calling Buffer.fill or Buffer.alloc with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc and Buffer.fill were updated so that they zero fill instead of hanging in these cases. All versions of...

Malicious JavaScript Package Detection

Detection and reporting of known malicious JavaScript packages or package versions. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Cross-site Scripting (XSS)

chosen-js is vulnerable to cross-site scripting XSS attacks. The application does not properly escape the grouplabel before rendering it, allowing a malicious user to inject and execute arbitrary Javascript...

chakra: Crash in JsUtil::BaseDictionary<int, SList<Js::InlineCache*, Memory::ArenaAllocator, Fake

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5985642830888960 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001048 Crash State: JsUtil::BaseDictionaryint,...

Directory Traversal

cyber-js is vulnerable to directory traversal. This attack is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

Malicious Typo-Squatting

nodemailer-js is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...

AZL-44400 CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

CVE-2017-16093

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Code injection

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

CVE-2017-16071 concerns the npm package nodemailer-js , described as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected advisories corroborate malware behavior and provide remediation gui...

CVE-2017-16093

CVE-2017-16093 concerns the cyber-js project, a simple http server, vulnerable to directory traversal that allows an attacker to access the filesystem by placing a relative path (e.g., ../../) in the URL. Connected sources confirm the vulnerability affects the cyber-js package and describe the at...

A MitM extension for Chrome

Browser extensions make our lives easier: they hide obtrusive advertising, translate text, help us choose in online stores, etc. There are also less desirable extensions, including those that bombard us with advertising or collect information about our activities. These pale into insignificance,...

Malicious Typo-Squatting

D3.js was a malicious module as it is developed to hijack environment variables and send it to attacker’s controlled location...

Man-In-The-Middle (MitM)

js-given is vulnerable to man-in-the-middle MitM attacks. This is because it downloads binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the netwo...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

AZL-44547 CVE-2017-16042 affecting package js-jquery 3.5.0-4

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution...

CVE-2017-16044

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...