CVE-2015-9243: Improper Access Control

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2014-10068: Improper Limitation of a Pathname to a Restricted Directory

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when showHidden is false...

CVE-2018-3734: Improper Limitation of a Pathname to a Restricted Directory

stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file with known path...

CVE-2015-9240: Undefined Security Weakness

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

PT-2018-16166 · Node · Html-Pages

Name of the Vulnerable Software and Affected Versions: html-pages versions prior to 2.1.0 Description: The issue allows an attacker to read any file from the server, potentially using tools like cURL. This is due to a path traversal vulnerability in the html-pages node module. Recommendations:...

PT-2018-4555

Name of the Vulnerable Software and Affected Versions ecstatic versions prior to 1.4.0 Description The issue arises when certain input strings are passed to new Date or Date.parse in the ecstatic node module, causing v8 to raise an exception and leading to a crash and denial of service. This occu...

CVE-2015-9241: Uncontrolled Resource Consumption

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out default node timeout is 2...

CVE-2015-9244: Improper Neutralization of Special Elements used in an SQL Command

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with mysql.escape which could lead to SQL Injection...

PT-2018-4557

Name of the Vulnerable Software and Affected Versions mysql versions prior to 2.0.0-alpha8 Description The issue is related to SQL Injection due to the lack of proper escaping of object keys with mysql.escape in the mysql node module. This could lead to SQL Injection attacks. Recommendations Upda...

CVE-2018-3750

The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all object...

CVE-2018-3728

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...

CVE-2018-3728

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...

Code injection

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...

DEBIAN-CVE-2018-3728

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...

CVE-2018-3728

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...

CVE-2018-3728

CVE-2018-3728 affects the hoek npm package. It is vulnerable to prototype pollution via the merge and applyToDefaults utilities, allowing an attacker to modify Object.prototype through proto and corrupt properties on all objects. Affected versions are hoek before 4.2.0 and 5.0.x before 5.0.3. Rem...

Downloads Resources over HTTP

Overview Affected versions of atom-node-module-installer insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in...

Electron Elevation of Privilege Vulnerability

Electron is a set of cross-platform desktop application development tools based on Web technology . A security vulnerability exists in Electron versions prior to 0.33.5, which can be exploited by an attacker to execute arbitrary programs with elevated privileges via a malicious Node module...

[SECURITY] Fedora 18 Update: nodejs-init-package-json-0.0.10-1.fc18

A node module to get your node module started, by creating its package.json metadata file...

CVE-2012-4473

The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node type page" permission to access unpublished nodes via a direct request...