Vulnerabilities > Nodejs > Node JS > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-05-04 CVE-2017-3732 Information Exposure vulnerability in multiple products
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d.
network
high complexity
openssl nodejs CWE-200
5.9
2017-01-23 CVE-2014-9772 Cross-site Scripting vulnerability in Nodejs Node.Js
The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.
network
low complexity
nodejs CWE-79
6.1
2017-01-23 CVE-2013-7454 Cross-site Scripting vulnerability in Nodejs Node.Js
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.
network
low complexity
nodejs CWE-79
6.1
2017-01-23 CVE-2013-7453 Cross-site Scripting vulnerability in Nodejs Node.Js
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
network
low complexity
nodejs CWE-79
6.1
2017-01-23 CVE-2013-7452 Cross-site Scripting vulnerability in Nodejs Node.Js
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.
network
low complexity
nodejs CWE-79
6.1
2017-01-23 CVE-2013-7451 Cross-site Scripting vulnerability in Nodejs Node.Js 1.0.4
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
network
low complexity
nodejs CWE-79
6.1
2016-10-10 CVE-2016-7099 Data Processing Errors vulnerability in multiple products
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
network
high complexity
nodejs suse CWE-19
5.9
2016-10-10 CVE-2016-5325 HTTP Response Splitting vulnerability in multiple products
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
network
low complexity
nodejs suse CWE-113
6.1
2016-09-26 CVE-2016-6306 Out-of-bounds Read vulnerability in multiple products
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
network
high complexity
openssl hp novell nodejs debian canonical CWE-125
5.9
2016-09-25 CVE-2016-5172 Information Exposure vulnerability in multiple products
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.
network
low complexity
google nodejs debian CWE-200
6.5