National Vulnerability Database

Subscribe to National Vulnerability Database feed
This feed contains the most recent CVE cyber vulnerabilities published within the National Vulnerability Database.
Updated: 13 hours 9 min ago

CVE-2016-10541

Thu, 05/31/2018 - 16:29
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
Categories: Security News

CVE-2016-10542

Thu, 05/31/2018 - 16:29
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Categories: Security News

CVE-2016-10543

Thu, 05/31/2018 - 16:29
call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.
Categories: Security News

CVE-2016-10544

Thu, 05/31/2018 - 16:29
uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.
Categories: Security News

CVE-2016-10546

Thu, 05/31/2018 - 16:29
An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands.
Categories: Security News

CVE-2016-10547

Thu, 05/31/2018 - 16:29
Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.
Categories: Security News

CVE-2016-10548

Thu, 05/31/2018 - 16:29
Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.
Categories: Security News

CVE-2016-10549

Thu, 05/31/2018 - 16:29
Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.
Categories: Security News

CVE-2016-10550

Thu, 05/31/2018 - 16:29
sequalize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Categories: Security News

CVE-2016-10552

Thu, 05/31/2018 - 16:29
igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
Categories: Security News

CVE-2016-10553

Thu, 05/31/2018 - 16:29
sequalize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
Categories: Security News

CVE-2014-10064

Thu, 05/31/2018 - 16:29
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Categories: Security News

CVE-2014-10065

Thu, 05/31/2018 - 16:29
Certain input when passed into remarkable before 1.4.1 will bypass the bad prototcol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.
Categories: Security News

CVE-2014-10066

Thu, 05/31/2018 - 16:29
Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.
Categories: Security News

CVE-2015-9236

Thu, 05/31/2018 - 16:29
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
Categories: Security News

CVE-2015-9238

Thu, 05/31/2018 - 16:29
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Categories: Security News

CVE-2015-9239

Thu, 05/31/2018 - 16:29
ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
Categories: Security News

CVE-2016-10518

Thu, 05/31/2018 - 16:29
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
Categories: Security News

CVE-2016-10519

Thu, 05/31/2018 - 16:29
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
Categories: Security News

CVE-2016-10520

Thu, 05/31/2018 - 16:29
jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
Categories: Security News

Pages