|
246211
|
7.8 |
HIGH
Local
|
micco
|
unlha32.dll
|
Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
|
CWE-426
Untrusted Search Path
|
CVE-2018-16189
|
2024-11-21 12:52 |
2019-02-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246212
|
7.5 |
HIGH
Network
|
static-resource-server_project
|
static-resource-server
|
A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL.
|
CWE-22
Path Traversal
|
CVE-2018-16493
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246213
|
9.8 |
CRITICAL
Network
|
extend_project
|
extend
|
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
|
CWE-74
Injection
|
CVE-2018-16492
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246214
|
9.8 |
CRITICAL
Network
|
dreamerslab
|
node.extend
|
A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
|
CWE-74
Injection
|
CVE-2018-16491
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246215
|
7.5 |
HIGH
Network
|
mpath_project
|
mpath
|
A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
|
CWE-74
Injection
|
CVE-2018-16490
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246216
|
9.8 |
CRITICAL
Network
|
just-extend_project
|
just-extend
|
A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.
|
CWE-74
Injection
|
CVE-2018-16489
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246217
|
5.6 |
MEDIUM
Network
|
lodash
|
lodash
|
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
|
NVD-CWE-noinfo
|
CVE-2018-16487
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246218
|
9.8 |
CRITICAL
Network
|
defaults-deep_project
|
defaults-deep
|
A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.
|
CWE-74
Injection
|
CVE-2018-16486
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246219
|
6.5 |
MEDIUM
Network
|
m-server_project
|
m-server
|
Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
|
CWE-22
Path Traversal
|
CVE-2018-16485
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
246220
|
5.4 |
MEDIUM
Network
|
m-server_project
|
m-server
|
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
|
CWE-79
Cross-site Scripting
|
CVE-2018-16484
|
2024-11-21 12:52 |
2019-02-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
