National Vulnerability Database

Subscribe to National Vulnerability Database feed
This feed contains the most recent CVE cyber vulnerabilities published within the National Vulnerability Database.
Updated: 18 hours 55 min ago

CVE-2017-16136

Wed, 06/06/2018 - 22:29
method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.
Categories: Security News

CVE-2017-16137

Wed, 06/06/2018 - 22:29
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Categories: Security News

CVE-2017-16138

Wed, 06/06/2018 - 22:29
The mime module is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Categories: Security News

CVE-2017-16139

Wed, 06/06/2018 - 22:29
jikes is a file server. jikes is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Accessible files are restricted to files with .htm and .js extensions.
Categories: Security News

CVE-2017-16140

Wed, 06/06/2018 - 22:29
lab6.brit95 is a file server. lab6.brit95 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16096

Wed, 06/06/2018 - 22:29
serveryaozeyan is a simple HTTP server. serveryaozeyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Categories: Security News

CVE-2017-16097

Wed, 06/06/2018 - 22:29
tiny-http is a simple http server. tiny-http is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16098

Wed, 06/06/2018 - 22:29
charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb, so the impact of the ReDoS is relatively low.
Categories: Security News

CVE-2017-16099

Wed, 06/06/2018 - 22:29
The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.
Categories: Security News

CVE-2017-16100

Wed, 06/06/2018 - 22:29
dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.
Categories: Security News

CVE-2017-16101

Wed, 06/06/2018 - 22:29
serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Categories: Security News

CVE-2017-16102

Wed, 06/06/2018 - 22:29
serverhuwenhui is a simple http server. serverhuwenhui is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Categories: Security News

CVE-2017-16103

Wed, 06/06/2018 - 22:29
serveryztyzt is a simple http server. serveryztyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Categories: Security News

CVE-2017-16104

Wed, 06/06/2018 - 22:29
citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16105

Wed, 06/06/2018 - 22:29
serverwzl is a simple http server. serverwzl is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.
Categories: Security News

CVE-2017-16106

Wed, 06/06/2018 - 22:29
tmock is a static file server. tmock is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16107

Wed, 06/06/2018 - 22:29
pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16108

Wed, 06/06/2018 - 22:29
gaoxiaotingtingting is an HTTP server. gaoxiaotingtingting is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

CVE-2017-16109

Wed, 06/06/2018 - 22:29
easyquick is a simple web server. easyquick is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. Access is constrained, however, to supported file types. Requesting a file such as /etc/passwd returns a "not supported" error.
Categories: Security News

CVE-2017-16110

Wed, 06/06/2018 - 22:29
weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
Categories: Security News

Pages