2018

appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP,

igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Ko

express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mon

Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to mak

The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable unde

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it di

i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API e

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS

jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in t

jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memo

ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.

Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacke

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string repr

SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys func

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible

The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies o

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on

In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over

In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Discl

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Pri

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclos

Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.

ClipperCMS 1.3.3 allows Session Fixation.

TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execu

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that can

Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 P

A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on vari

The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code execution

tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in lib

tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code t

An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connectio

VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege escalation vulnerability due to

stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malici

crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url

An arbitrary file upload vulnerability in /classes/profile.class.php in Jigowatt "PHP Login & User Management" before 4.

gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in t