Hackerone vulnerabilities, page 2
470 vulnerabilities
Known vulnerabilities in Hackerone products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 447 products.
CVE-2018-3716hackeronesimplehttpserver node module+1
EPSS score0.63%
simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.CVE-2018-3738hackeroneprotobufjs node module+2EPSS score0.94%
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.CVE-2018-3725hackeronehekto node module+2EPSS score2.01%
hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.CVE-2018-3721debiannode-lodash+7EPSS score2.35%
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.CVE-2018-3770hackeronemarkdown-pdf+2EPSS score0.50%
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.CVE-2018-3787hackeronesimplehttpserver+2EPSS score2.04%
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.CVE-2018-3715glance_projectglance+2EPSS score1.46%
glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.CVE-2018-3730hackeronemcstatic node module+2EPSS score2.01%
mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.CVE-2018-3744hackeronehtml-pages node module+2EPSS score2.24%
The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.CVE-2018-3771hackeronestatics-server+2EPSS score0.93%
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.CVE-2018-3778aedes_projectaedes+2EPSS score1.42%
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.CVE-2018-3712hackeroneserve node module+2EPSS score1.79%
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.CVE-2018-3759RubyGemsprivate_address_check+2EPSS score0.69%
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.CVE-2018-3774debiannode-url-parse+4EPSS score3.81%
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.CVE-2018-3714hackeronenode-srv node module+1EPSS score8.57%
node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.CVE-2018-3755hackeronesexstatic+2EPSS score0.92%
XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.CVE-2018-3760debianruby-sprockets+18EPSS score26.72%
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.CVE-2018-3722hackeronemerge-deep node module+2EPSS score2.00%
merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.CVE-2018-3775hackeronenextcloud server+1EPSS score1.23%
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.CVE-2018-3776hackeronenextcloud server+1EPSS score1.26%
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.