5597 matches found
Lodash Template - Server-Side Template Injection (RCE)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...
Node.js st module Directory Traversal
A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...
Node.JS System Information Library <5.3.1 - Remote Command Injection
Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...
htcap
HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...
nodejshell
NODEJSHELL - Reverse shell exploit for NodeJs deserialization CVE-2017-5941 The exploit automatically generates the reverse shell payload which is encoded in decimal and then in base64. After that, this payload is sent via an HTTP POST request that serializes the user input and stores it in a...
witcher
witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...
h8mail
h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...
XploitSPY
A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...
Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3297)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3297 advisory. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in...
CLSA-2026-1792760716 nodejs: Fix of 3 CVEs
CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve and setLocalAddress APIs, so c-ares can no longer silently truncate the queried name - CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity and restore IPv6 IP SAN...
CLSA-2026-1792746902 nodejs: Fix of 3 CVEs
CVE-2026-105482: reject names and local addresses with null bytes in the dns resolve and setLocalAddress APIs, so c-ares can no longer silently truncate the queried name - CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in tls.checkServerIdentity and restore IPv6 IP SAN...
AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792746902)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792746902 advisory. - This vulnerability affects Node.js 26.x, 24.x, and 22.x. Thank you, to hasanfleyah for reporting this vulnerability and thank you...
0xsp-Mongoose
Support the project for continuous development ETH 0xf340c15c5e669a4ababab856e9f2bccd659d6e42 0xsp Mongoose RED for Windows Current Release 2.2.0 0xsp mongoose red version is provided to assist your needs during cyber security simulation, by using this version you will be able to audit a targeted...
PT-2026-121688
@MarkusEicher70 MacMarkus, as you are asking, here a stupid question The list below looks complete, but something is missing! For sure! CVSS=9.2 October 21st 2026 1. PHP Engine vulerability – "PHP2Shell" CVE-2026-109618 and CVE-2026-109619 Patched Versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35...
GHSA-8R9P-F939-6H3C vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, configurable-http-proxy, lambda-nodejs, semaphore, redisinsight, lerna, commercial-gitlab-rails-ee-fips, azurite, unleash, opensearch-dashboards, langfuse, code-server, unleash-fips, opensearch-dashboards-fips, wazuh-dashboard-fips, prism,...
CVE-2026-111756 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, configurable-http-proxy, lambda-nodejs, semaphore, redisinsight, lerna, commercial-gitlab-rails-ee-fips, azurite, unleash, opensearch-dashboards, langfuse, code-server, unleash-fips, opensearch-dashboards-fips, wazuh-dashboard-fips, prism,...
GHSA-Q3JH-WRC6-JGQ8 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, configurable-http-proxy, lambda-nodejs, semaphore, redisinsight, lerna, commercial-gitlab-rails-ee-fips, azurite, unleash, opensearch-dashboards, langfuse, code-server, unleash-fips, opensearch-dashboards-fips, wazuh-dashboard-fips, prism,...
CVE-2026-111755 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, configurable-http-proxy, lambda-nodejs, semaphore, redisinsight, lerna, commercial-gitlab-rails-ee-fips, azurite, unleash, opensearch-dashboards, langfuse, code-server, unleash-fips, opensearch-dashboards-fips, wazuh-dashboard-fips, prism,...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch via the checkServerIdentity function in lib/tls.js. An attacker can bypass certificate hostname checks by getting a TLS client to connect using fullwidth digits representing an IPv4...