CVE’s

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

This affects the package simpl-schema before 1.10.2.

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.