PT-2018-6166

Name of the Vulnerable Software and Affected Versions: jikes versions affected versions not specified Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability. This is achieved by placing "../" in the URL, granting access to files outsid...

PT-2018-6122

Name of the Vulnerable Software and Affected Versions: cyber-js versions affected versions not specified Description: The issue concerns a directory traversal problem, allowing an attacker to access the filesystem by manipulating the URL with "../". This can lead to the disclosure of private file...

PT-2018-6099

Name of the Vulnerable Software and Affected Versions: nodemailer-js versions all Description: The issue concerns a malicious module named nodemailer-js that was published with the intent to hijack environment variables, specifically designed to steal and send them to attacker-controlled location...

CVE-2017-16071: Embedded Malicious Code

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16093: Improper Limitation of a Pathname to a Restricted Directory

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

A MitM extension for Chrome

Browser extensions make our lives easier: they hide obtrusive advertising, translate text, help us choose in online stores, etc. There are also less desirable extensions, including those that bombard us with advertising or collect information about our activities. These pale into insignificance,...

Malicious Typo-Squatting

D3.js was a malicious module as it is developed to hijack environment variables and send it to attacker’s controlled location...

Man-In-The-Middle (MitM)

js-given is vulnerable to man-in-the-middle MitM attacks. This is because it downloads binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the netwo...

AZL-44547 CVE-2017-16042 affecting package js-jquery 3.5.0-4

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16044

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

Code injection

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16044

"d3.js" was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16044

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16053

The CVE-2017-16053 issue involves the npm package fabric-js , published as malware intended to hijack environment variables. Several connected sources (GHSA advisory, npm advisory, and CVE records) confirm that all versions were unpublished from the npm registry and that the malware steals enviro...