2018

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can b

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPres

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notificatio

mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which lea

bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary reso

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza vers

operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which

apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This all

iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, whi

Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a dire

galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources

appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP,

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algo

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the

Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS)

An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB te

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 tha

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shel

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Ko

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allo

backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-dire

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail

electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mon

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass

marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parse

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can oft

Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to mak

restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Re

The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable unde

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it di

i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API e

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS

jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in t

jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memo

ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first ar