Vulnerabilidades de Npm
CVEs publicadas que afetam produtos de Npm: 133 registro(s), com severidade, exploração e correções.
Payload 16Electron 7Fast-uri 5Lodash-es 4Lodash 4Hono 4Tinymce 4@steipete/summarize 4Ghost 3Lodash-amd 3Music-metadata 3Pnpm 3Unleash-server 3Lodash.template 2Lodash.unset 2@backstage/plugin-kubernetes-backend 2N8n 2@backstage/plugin-catalog-backend 2@backstage/plugin-scaffolder-backend-module-confluence-to-markdown 2Engine.io 2@backstage/plugin-scaffolder-backend 2Msgpack5 2Elysia 2Mjml 2Misskey-js 2Axios 2@asymmetric-effort/specifyjs 2@opennextjs/cloudflare 1React-server-dom-webpack 1React-server-dom-turbopack 1React-server-dom-parcel 1Puppeteer 1Systeminformation 1@quasar/app-vite 1Tinacms 1@tinacms/app 1Flowise 1Braces 1Http-cache-semantics 1Minimist 1
CVE-2021-44906
Crítica · 9.8
CWE-1321 17/03/2022
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVE-2021-21315
Alta · 7.8
KEV Alta · 66 Exploit público CWE-78 16/02/2021
System Information Library for Node.JS Command Injection
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVE-2021-23337
Alta · 7.2
Exploit público CWE-94 15/02/2021
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-12827
Alta · 7.2
CWE-22 17/06/2020
MJML vulnerable to path traversal
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
CVE-2020-11023
Média · 6.1
KEV Alta · 67 Exploit público CWE-79 29/04/2020
JQuery Cross-Site Scripting (XSS) Vulnerability
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-10758
Crítica · 9.9
KEV Urgente · 70 Exploit público CWE-94 24/12/2019
MongoDB mongo-express Remote Code Execution Vulnerability
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
CVE-2019-5786
Média · 6.5
KEV Urgente · 73 Exploit público CWE-416 27/06/2019
Vulnerabilidade de Use-After-Free no Blink do Google Chrome
Problema de tempo de vida de objeto no Blink no Google Chrome anterior à 72.0.3626.121 permitia que um atacante remoto potencialmente realizasse acesso à memória fora dos limites por meio de uma página HTML elaborada.
CVE-2017-16137
Média · 5.3
CWE-400 06/06/2018
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.