2018

node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished b

tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm

mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below

mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources o

massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be p

roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary

adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloa

selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-dri

limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over

tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leave

poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to

native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves i

ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnera

broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources ove

scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to M

strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which le

webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr dow

ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulner

Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resourc

cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves i

selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTT

macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads bina

dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary re

unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over

ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads b

baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versio

pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over

geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all t

install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download bi

selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-downloa

aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP,

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Mi

Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to ra

Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addres

The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, ev

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditio

An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php al

A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cau

The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attacker

PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Unrestricted Upload of a File with a Dangerous Type in edit_re

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a de

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat outp

PHP Scripts Mall Website Seller Script 2.0.3 has CSRF via user_submit.php?upd=2, with resultant XSS.

An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType

In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product was renamed), there is an unchecked buffer size durin

The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move,

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m