HackerOne vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2017-0938 Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.High 7.5 · Feb 12, 2019
• CVE-2018-16493 A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slasHigh 7.5 · Feb 1, 2019
• CVE-2018-16492 A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.Critical 9.8 · Feb 1, 2019
• CVE-2018-16491 A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.Critical 9.8 · Feb 1, 2019
• CVE-2018-16490 A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.High 7.5 · Feb 1, 2019
• CVE-2018-16489 A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.Critical 9.8 · Feb 1, 2019
• CVE-2018-16486 A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.Critical 9.8 · Feb 1, 2019
• CVE-2018-16483 A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.High 8.8 · Feb 1, 2019
• CVE-2018-16482 A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file sysHigh 7.5 · Feb 1, 2019
• CVE-2018-16479 Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.High 7.5 · Feb 1, 2019
• CVE-2018-16469 The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.High 7.5 · Oct 30, 2018
• CVE-2018-3787 Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.High 7.5 · Aug 31, 2018
• CVE-2018-3775 Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor AuthenticationHigh 8.8 · Aug 12, 2018
• CVE-2018-3774 Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication ProtocolCritical 10 · Aug 12, 2018
• CVE-2018-3779 active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor.Critical 9.8 · Aug 10, 2018
• CVE-2018-3760 There is an information leak vulnerability in Sprockets.High 7.5 · Jun 26, 2018
• CVE-2018-3758 Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.High 8.8 · Jun 7, 2018
• CVE-2018-3739 https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setupCritical 9.1 · Jun 6, 2018
• CVE-2018-3737 sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.High 7.5 · Jun 6, 2018
• CVE-2018-3732 resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which alloHigh 7.5 · Jun 6, 2018
• CVE-2018-3731 public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file High 7.5 · Jun 6, 2018
• CVE-2018-3730 mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any filHigh 7.5 · Jun 6, 2018
• CVE-2018-3729 localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any fiHigh 7.5 · Jun 6, 2018
• CVE-2018-3727 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with knHigh 7.5 · Jun 6, 2018
• CVE-2018-3725 hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with High 7.5 · Jun 6, 2018