CVE-2018-3723

CVE-2018-3723 affects defaults-deep prior to 0.2.4, enabling prototype pollution by abusing proto to modify Object.prototype. This can lead to added or altered properties existing on all objects, with potential DoS and, in some cases, remote code execution as described in linked advisories. The i...

CVE-2018-3722

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3721

CVE-2018-3721 relates to the lodash node module prior to 4.17.5, enabling a prototype pollution MAID vulnerability through defaultsDeep, merge, and mergeWith that could modify Object.prototype via proto . The provided IBM security bulletin corroborates the vulnerability details for this CVE and l...

CVE-2018-3716

CVE-2018-3716 affects the simplehttpserver Node.js module. The vulnerability is a stored XSS in directory listings caused by lack of validation/sanitization of file names fed into HTML output. Exploitation requires an attacker-controlled filename in the listing; the XSS payload is reflected in th...

CVE-2018-3724

general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path...

CVE-2018-3717

connect node module before 2.14.0 suffers from a Cross-Site Scripting XSS vulnerability due to a lack of validation of file in directory.js middleware...

CVE-2018-3720

The CVE-2018-3720 entry concerns the assign-deep Node.js module. Versions prior to 0.4.7 are affected by a prototype-pollution (MAID) vulnerability that lets an attacker modify Object.prototype via proto , enabling addition or modification of properties that propagate to all objects. Impact is de...

CVE-2018-3722

The CVE-2018-3722 entry concerns the merge-deep npm module, specifically versions before 3.0.1. A MAID/prototype-pollution flaw via proto enables an attacker to modify the prototype of Object, potentially adding or altering properties that exist on all objects. This can lead to server instability...

CVE-2018-3725

hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...

CVE-2018-3714

CVE-2018-3714 affects the Node.js module node-srv via a local file inclusion (path traversal) vulnerability caused by insufficient URL validation. An attacker can read arbitrary files on the server when serving content, as demonstrated across multiple sources (NVD entry, GHSA advisory, OpenVAS/Nu...

CVE-2018-3732

The CVE-2018-3732 issue affects the resolve-path Node.js module prior to version 1.4.0. It suffers from a path traversal vulnerability due to insufficient validation of certain special-character paths, enabling a malicious user to read contents of files at known paths. Public reports across NVD, ...

CVE-2018-3716: Improper Neutralization of Input During Web Page Generation

simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names...

CVE-2018-3729: Improper Limitation of a Pathname to a Restricted Directory

localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...

PT-2018-16154 · Node.Js · Mcstatic

Name of the Vulnerable Software and Affected Versions: mcstatic versions all Description: The mcstatic node module has a Path Traversal issue due to the lack of validation of the filePath, allowing a malicious user to read the content of any file with a known path. Recommendations: For all...

CVE-2018-3731: Improper Limitation of a Pathname to a Restricted Directory

public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path...

CVE-2018-3725: Improper Limitation of a Pathname to a Restricted Directory

hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...

PT-2018-16139

Name of the Vulnerable Software and Affected Versions glance versions prior to 3.0.4 Description The issue is related to a Path Traversal vulnerability due to the lack of validation of the path passed to the glance node module. This allows a malicious user to read the content of any file with a...

PT-2018-16142 · Node.Js · Serve

Name of the Vulnerable Software and Affected Versions: serve node module affected versions not specified Description: The issue is related to improper handling of URL encoding, allowing access to ignored files if a filename is URL encoded. This can potentially lead to unauthorized access to...

CVE-2018-3727: Improper Limitation of a Pathname to a Restricted Directory

626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...

CVE-2018-3719: Modification of Assumed-Immutable Data (MAID)

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...