EUVD-2018-0577

Malware in sbrugna...

GHSA-CGJX-MWPX-47JV Private Data Disclosure in express-restify-mongoose

Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the following User...

Private Data Disclosure in express-restify-mongoose

Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the following User...

express-restify-mongoose information disclosure vulnerability

express-restify-mongoose is a tool for creating interfaces for Mongoose Model. A security vulnerability exists in express-restify-mongoose version 2.4.2 and earlier and versions 3.0.X through 3.0.1. An attacker can exploit the vulnerability by sending a request to obtain the passwords of all user...

CVE-2016-10533

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the...

CVE-2016-10533

CVE-2016-10533 affects express-restify-mongoose. Vulnerable versions (2.4.2 and earlier, and 3.0.X through 3.0.1) allow a malicious user to abuse GET /User?distinct=password to retrieve all user passwords, bypassing private field protections. The root cause is information leakage through listing/...

CVE-2016-10533

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for "GET /User?distinct=password" and get all the passwords for all the users in the...

inno-admin (0.0.3), rupert-plugin-mongo (>=0.0.1, <=0.0.6) +1 more potentially affected by CVE-2016-10533 via express-restify-mongoose (>=0.6.8, <=1.1.2)

express-restify-mongoose NPM version =0.6.8, =0.0.1, =0.0.6 - zazu 0.0.1 Source cves: CVE-2016-10533 Source advisory: MEND:CVE-2016-10533...

PT-2018-4712

Name of the Vulnerable Software and Affected Versions express-restify-mongoose versions 2.4.2 and earlier express-restify-mongoose versions 3.0.0 through 3.0.1 Description The issue allows a malicious user to send a request for "GET /User?distinct=password" and get all the passwords for all the...

CVE-2016-10533: Exposure of Sensitive Information to an Unauthorized Actor

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for GET /User?distinct=password and get all the passwords for all the users in the...

Private Data Disclosure

Overview Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the...