HA
Vendor
HackerOne
23
CVEs
0
On KEV
0
New 30D
Products
MS6.5
m-server
HackerOne
2 CVEs0 on KEV0 new
NS8.8
Nextcloud Server
HackerOne
2 CVEs0 on KEV0 new
AR9.8
active-support ruby gem
HackerOne
1 CVEs0 on KEV0 new
AE5.3
aedes
HackerOne
1 CVEs0 on KEV0 new
AE7.5
airMAX, EdgeMAX
HackerOne
1 CVEs0 on KEV0 new
DN5.3
debug node module
HackerOne
1 CVEs0 on KEV0 new
DE9.8
defaults-deep
HackerOne
1 CVEs0 on KEV0 new
EX8.8
express-cart
HackerOne
1 CVEs0 on KEV0 new
EX9.8
extend
HackerOne
1 CVEs0 on KEV0 new
FN7.5
fresh node module
HackerOne
1 CVEs0 on KEV0 new
HT6.1
html-pages
HackerOne
1 CVEs0 on KEV0 new
HT7.5
http-live-simulator
HackerOne
1 CVEs0 on KEV0 new
JU9.8
just-extend
HackerOne
1 CVEs0 on KEV0 new
LO5.6
lodash
HackerOne
1 CVEs0 on KEV0 new
MC7.5
mcstatic
HackerOne
1 CVEs0 on KEV0 new
MN7.5
mime node module
HackerOne
1 CVEs0 on KEV0 new
MP7.5
mpath
HackerOne
1 CVEs0 on KEV0 new
NO9.8
node.extend
HackerOne
1 CVEs0 on KEV0 new
PU6.1
public
HackerOne
1 CVEs0 on KEV0 new
ST7.5
static-resource-server
HackerOne
1 CVEs0 on KEV0 new
UR10.0
url-parse
HackerOne
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2017-0938 | AE airMAX, EdgeMAX HackerOne | 7.5 | Feb 12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks |
| CVE-2018-16482 | MC mcstatic HackerOne | 7.5 | Feb 1 | A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending… |
| CVE-2018-16485 | MS m-server HackerOne | 6.5 | Feb 1 | Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g |
| CVE-2018-16486 | DE defaults-deep HackerOne | 9.8 | Feb 1 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype |
| CVE-2018-16487 | LO lodash HackerOne | 5.6 | Feb 1 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of… |
| CVE-2018-16489 | JU just-extend HackerOne | 9.8 | Feb 1 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions |
| CVE-2018-16490 | MP mpath HackerOne | 7.5 | Feb 1 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype |
| CVE-2018-16491 | NO node.extend HackerOne | 9.8 | Feb 1 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype |
| CVE-2018-16492 | EX extend HackerOne | 9.8 | Feb 1 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype |
| CVE-2018-16493 | ST static-resource-server HackerOne | 7.5 | Feb 1 | A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL |
| CVE-2018-16479 | HT http-live-simulator HackerOne | 7.5 | Feb 1 | Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL |
| CVE-2018-16480 | PU public HackerOne | 6.1 | Feb 1 | A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names… |
| CVE-2018-16481 | HT html-pages HackerOne | 6.1 | Feb 1 | A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths… |
| CVE-2018-16483 | EX express-cart HackerOne | 8.8 | Feb 1 | A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators |
| CVE-2018-16484 | MS m-server HackerOne | 5.4 | Feb 1 | A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder… |
| CVE-2018-3776 | NS Nextcloud Server HackerOne | 5.3 | Aug 12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log |
| CVE-2018-3774 | UR url-parse HackerOne | 10.0 | Aug 12 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol |
| CVE-2018-3775 | NS Nextcloud Server HackerOne | 8.8 | Aug 12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication |
| CVE-2018-3779 | AR active-support ruby gem HackerOne | 9.8 | Aug 10 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor |
| CVE-2018-3778 | AE aedes HackerOne | 5.3 | Aug 8 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized |
| CVE-2017-16119 | FN fresh node module HackerOne | 7.5 | Jun 7 | Fresh is a module used by the Express.js framework for HTTP response freshness testing |
| CVE-2017-16137 | DN debug node module HackerOne | 5.3 | Jun 7 | The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter |
| CVE-2017-16138 | MN mime node module HackerOne | 7.5 | Jun 7 | The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input |