Vulnerabilities in HackerOne
470 resultsCVE-2017-16098—charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down oEPSS 1.6%CVE-2016-10682—massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remEPSS 1.6%CVE-2016-10566—install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over EPSS 1.6%CVE-2016-10601—webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resourEPSS 1.6%CVE-2016-10567—product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information aboutEPSS 1.6%CVE-2016-10635—broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leavesEPSS 1.6%CVE-2016-10666—tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MEPSS 1.6%CVE-2016-10519—A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and EPSS 1.6%CVE-2016-10526—A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth pEPSS 1.6%CVE-2016-10595—jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacEPSS 1.6%CVE-2016-10608—robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to EPSS 1.6%CVE-2014-10066—Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input EPSS 1.6%CVE-2017-16119HIGHFresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of sEPSS 1.6%CVE-2016-10527—The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditionsEPSS 1.6%CVE-2017-16013—hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught EPSS 1.6%CVE-2017-16099—The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can EPSS 1.6%CVE-2017-16117—slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially cEPSS 1.6%CVE-2015-9236—Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at wEPSS 1.5%CVE-2016-10540—Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `mEPSS 1.5%CVE-2016-10577—ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources overEPSS 1.5%