Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
npmjs npm vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2020-7754
This affects the package npm-user-validate prior to 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Npmjs Npm-user-validate
7.5
CVSSv3
CVE-2016-3956
The CLI in npm prior to 2.15.1 and 3.x prior to 3.8.3, as used in Node.js 0.10 prior to 0.10.44, 0.12 prior to 0.12.13, 4 prior to 4.4.2, and 5 prior to 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by rea...
Ibm Sdk
Nodejs Node.js 5.6.0
Nodejs Node.js 4.4.0
Nodejs Node.js 4.3.2
Nodejs Node.js 4.3.1
Nodejs Node.js 5.2.0
Nodejs Node.js 5.1.0
Nodejs Node.js 4.2.1
Nodejs Node.js 4.1.2
Nodejs Node.js 0.12.8
Nodejs Node.js 0.12.6
Nodejs Node.js 0.10.9
Nodejs Node.js 0.10.7
Nodejs Node.js 0.10.38
Nodejs Node.js 0.10.36
Nodejs Node.js 0.10.31
Nodejs Node.js 0.10.3
Nodejs Node.js 0.10.23
Nodejs Node.js 0.10.21
Nodejs Node.js 0.10.16
Nodejs Node.js 0.10.14
Nodejs Node.js 0.10.1
6.5
CVSSv3
CVE-2019-16775
Versions of the npm CLI before 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would all...
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
Npmjs Npm
Opensuse Leap 15.1
Oracle Graalvm 19.3.0.2
Oracle Graalvm 20.3.3
Oracle Graalvm 21.2.2
Fedoraproject Fedora 31
6.5
CVSSv3
CVE-2019-16777
Versions of the npm CLI before 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequ...
Npmjs Npm
Opensuse Leap 15.1
Oracle Graalvm 19.3.0.2
Fedoraproject Fedora 31
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
5.3
CVSSv3
CVE-2021-23362
The package hosted-git-info prior to 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Npmjs Hosted-git-info
Siemens Sinec Infrastructure Network Services
2 Github repositories
4.4
CVSSv3
CVE-2020-15095
Versions of the npm CLI before 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is no...
Npmjs Npm
Opensuse Leap 15.1
Opensuse Leap 15.2
Fedoraproject Fedora 33
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-5324
path traversal
CVE-2024-4743
CVE-2024-5184
TCP
CVE-2024-27822
code injection
CVE-2024-28995
CVE-2023-20938
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2