2018

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chro

The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registr

The module pandora-doomsday infects other modules. It's since been unpublished from the registry.

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command inje

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized use

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a speci

In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 41076000

In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an at

In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13

XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to re

QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities

The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attack

WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Dis

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute a

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker t

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00

Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior ma

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN

An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administr

Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a

Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of

Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).

Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.

The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbi

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the S

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB te

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shel

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE Syste

The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management

The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 thro

The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 thro

Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale)

ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.

ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.

/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a

md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_label mishandl

md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.

md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of a link lab