Forms Cross-Site Scripting Vulnerability

Forms is a tool for creating, parsing and validating forms in Node.js. A cross-site scripting vulnerability exists in Forms versions prior to 1.3.0, which stems from the program's failure to properly escape HTML and can be exploited by a remote attacker to inject arbitrary web script or HTML...

Node.js Denial of Service Vulnerability (CNVD-2018-11809)

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

UBUNTU-CVE-2018-7167

Calling Buffer.fill or Buffer.alloc with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc and Buffer.fill were updated so that they zero fill instead of hanging in these cases. All versions of...

Malicious JavaScript Package Detection

Detection and reporting of known malicious JavaScript packages or package versions. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Cross-site Scripting (XSS)

chosen-js is vulnerable to cross-site scripting XSS attacks. The application does not properly escape the grouplabel before rendering it, allowing a malicious user to inject and execute arbitrary Javascript...

chakra: Crash in JsUtil::BaseDictionary<int, SList<Js::InlineCache*, Memory::ArenaAllocator, Fake

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=5985642830888960 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001048 Crash State: JsUtil::BaseDictionaryint,...

Directory Traversal

cyber-js is vulnerable to directory traversal. This attack is possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

Malicious Typo-Squatting

nodemailer-js is a malicious typo-squatting package. The package uses a similar name to the original library so that developers may mistake it for the real one but have malicious actions under the hood such as stealing environment variables...

AZL-44400 CVE-2017-16137 affecting package js-jquery 3.5.0-4

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

CVE-2017-16093

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Code injection

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16071

CVE-2017-16071 concerns the npm package nodemailer-js , described as malware that hijacks environment variables and exfiltrates them to attacker-controlled locations. All versions were unpublished from the npm registry. Connected advisories corroborate malware behavior and provide remediation gui...

CVE-2017-16093

CVE-2017-16093 concerns the cyber-js project, a simple http server, vulnerable to directory traversal that allows an attacker to access the filesystem by placing a relative path (e.g., ../../) in the URL. Connected sources confirm the vulnerability affects the cyber-js package and describe the at...

CVE-2017-16071

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

PT-2018-6166

Name of the Vulnerable Software and Affected Versions: jikes versions affected versions not specified Description: The issue allows an attacker to access the filesystem by exploiting a directory traversal vulnerability. This is achieved by placing "../" in the URL, granting access to files outsid...

PT-2018-6099

Name of the Vulnerable Software and Affected Versions: nodemailer-js versions all Description: The issue concerns a malicious module named nodemailer-js that was published with the intent to hijack environment variables, specifically designed to steal and send them to attacker-controlled location...

PT-2018-6122

Name of the Vulnerable Software and Affected Versions: cyber-js versions affected versions not specified Description: The issue concerns a directory traversal problem, allowing an attacker to access the filesystem by manipulating the URL with "../". This can lead to the disclosure of private file...

CVE-2017-16071: Embedded Malicious Code

nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16093: Improper Limitation of a Pathname to a Restricted Directory

cyber-js is a simple http server. A cyberjs server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...