Dominictarr Libnested 安全漏洞

Dominictarr Libnested is a codebase from the Dominictarr individual developer that provides map, each, get, set, keys functions for basic nested objects. A security vulnerability exists in Dominictarr Libnested, which stems from the set function in index.js being susceptible to prototype...

Authorization Bypass

url-parse is vulnerable to authorization bypass. The vulnerability exists in Url function of index.js because the user name and password are not properly handled which allows a malicious user to modify user information...

Prototype Pollution

object-path-set is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the isValidKey function of index.js and modify attributes such as proto, constructor, and prototype...

Account Hijacking

simple-get users are vulnerable to account hijacking. The vulnerability in simpleGet function of index.js allow a remote attacker to provide a victim with a crafted URL, redirecting the victim to a malicious third party site. During the process victim's cookie is leaked to the attacker resulting ...

Prototype Pollution

extend2 is vulnerable to prototype pollution. The vulnerability exists in extend function of index.js as it allows an attacker to pass the value proto through the name variable...

Denial Of Service (DoS)

is-email is vulnerable to denial of service. The isEmail function in the index.js does not properly check the email length, allowing an attacker to crash the application by providing a long-length email...

Prototype Pollution in algoliasearch-helper

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

Cross-site Scripting (XSS)

apostrophe is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in index.js allowing an attacker to insert arbitrary Javascript...

Prototype Pollution

json-pointer is vulnerable to prototype pollution. The vulnerability exists in the 'set' function of 'index.js' as a bypass of a previous fix for a prototype pollution vulnerability. An attacker is able to inject arbitrary properties into existing construct prototypes and modification of attribut...

Cross-site Scripting (XSS)

bootstrap-table is vulnerable to cross-site scripting. Lack of input sanitization in the escapeHTML function of index.js allows an attacker to inject and execute malicious javascript even if the escape attribute is set...

Remote Code Execution (RCE)

aaptjs is vulnerable to remote code execution. The add function in index.js does not properly sanitize user-provided data, allowing an attacker to provide malicious code via its filePath parameter...

Command Injection

shell-quote is vulnerable to command injection. An attacker can inject unescaped shell metacharacters through a regex used in exports.quote function in the index.js...

Open Redirect in trailing-slash

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::createTrailing, as the web server uses relative URLs...

Prototype Pollution

body-parser-xml is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype in the index.js...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Command Injection in geojson2kml

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: js var a =require"geojson2kml"; a"./","& touch JHU",function...

OS Command Injection in closure-compiler-stream

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization...

OS Command Injection in docker-compose-remote-api

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within index.js of the package, the function execserviceName, cmd, fnStdout, fnStderr, fnExit uses the variable serviceName which can be controlled by users without any sanitization...

Path Traversal in marked-tree

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

GHSA-XR8H-53XR-JHCM Path Traversal in marked-tree

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...