HackerOne vulnerabilities

CVEs per yearBy the year they were published

1. 2018221
2. 2018177
3. 20189
4. 20185
5. 201958

Newest CVEs

• CVE-2017-0938

  Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.

  HackerOne · airMAX, EdgeMAX

  High7.5
• CVE-2018-16493

  A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending…

  HackerOne · static-resource-server

  High7.5
• CVE-2018-16492

  A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

  HackerOne · extend

  Critical9.8
• CVE-2018-16491

  A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

  HackerOne · node.extend

  Critical9.8
• CVE-2018-16490

  A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

  HackerOne · mpath

  High7.5
• CVE-2018-16489

  A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

  HackerOne · just-extend

  Critical9.8
• CVE-2018-16487

  A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying…

  HackerOne · lodash

  Medium5.6
• CVE-2018-16486

  A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

  HackerOne · defaults-deep

  Critical9.8
• CVE-2018-16485

  Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd…

  HackerOne · m-server

  Medium6.5
• CVE-2018-16484

  A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special…

  HackerOne · m-server

  Medium5.4