Vendor
HackerOne
470 known vulnerabilities in products by HackerOne, 0 of them actively exploited (CISA KEV).
Key figures
470
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
33
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2017-0903 | HackerOne RubyGems: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2017-0899 | HackerOne RubyGems: Improper Neutralization of Escape, Meta, or Control Sequences | 9.8 | |
| Critical | CVE-2017-16082 | HackerOne pg node module: Code Injection | 9.8 | |
| Critical | CVE-2015-9235 | HackerOne jsonwebtoken node module: Improper Input Validation | 9.8 | |
| High | CVE-2018-3758 | HackerOne Express-cart: Path Traversal | 8.8 | |
| Critical | CVE-2018-3779 | HackerOne active-support ruby gem: Command Injection | 9.8 | |
| Critical | CVE-2017-0898 | HackerOne Ruby: Use of Externally-Controlled Format String | 9.1 | |
| Critical | CVE-2017-16100 | HackerOne dns-sync node module: Code Injection | 9.8 | |
| Critical | CVE-2018-3746 | HackerOne Pdfinfojs: Command Injection | 9.8 | |
| Critical | CVE-2017-16042 | HackerOne growl node module: Code Injection | 9.8 | |
| Critical | CVE-2018-3774 | HackerOne Url-parse: Forced Browsing | 10.0 | |
| High | CVE-2017-0901 | HackerOne RubyGems: Path Traversal | 7.5 | |
| High | CVE-2018-3760 | HackerOne Sprockets: Path Traversal | 7.5 | |
| High | CVE-2017-0938 | UI AirOS: Uncontrolled Resource Consumption | 7.5 | |
| Critical | CVE-2017-16088 | HackerOne safe-eval node module: Externally Controlled Reference to a Resource in Another Sphere | 10.0 | |
| Critical | CVE-2017-16226 | HackerOne static-eval node module node module: Improper Input Validation | 9.8 | |
| Critical | CVE-2018-16492 | HackerOne Extend: Uncontrolled Resource Consumption | 9.8 | |
| High | CVE-2017-16086 | HackerOne ua-parser node module: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2016-10542 | HackerOne ws node module: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2017-0902 | HackerOne RubyGems: Reliance on Reverse DNS Resolution for a Security-Critical Action | 8.1 | |
| Critical | CVE-2017-16151 | HackerOne electron node module: Code Injection | 9.8 | |
| Critical | CVE-2016-10546 | HackerOne pouchdb node module: Code Injection | 9.8 | |
| Critical | CVE-2016-10525 | HackerOne hapi-auth-jwt2 node module: Authentication Bypass | 9.8 | |
| Critical | CVE-2017-16020 | HackerOne summit node module: Code Injection | 9.8 | |
| Critical | CVE-2015-9244 | HackerOne mysql node module: SQL Injection | 9.8 |
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| HackerOne RubyGems | 4 | 0 |
| Hapi Node Module | 4 | 0 |
| Sequelize Node Module | 4 | 0 |
| Coffeescript Node Module | 3 | 0 |