2018

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Dis

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute a

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.

nZEDb v0.7.3.3 has XSS in the 404 error page.

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mo

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This ca

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mo

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9

An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Serie

An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A spe

`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished b

`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished

`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by n

`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished b

`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished

`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by n

`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm

Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it

ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.

gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vul

`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to

`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesyst

`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by

`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory

The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and ea

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could

hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulner

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is ge

Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the spe

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a

The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories

Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1

Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not esc

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker t

GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or Asci

Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent U

sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scri

Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cro

Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means t

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that force

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding`

ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angul