HackerOne Vulnerabilities and Affected Products
Vulnerabilities associated with i18next node module.
Products
Clear product- hapi node module4 vulnerabilities
- RubyGems4 vulnerabilities
- sequelize node module4 vulnerabilities
- coffeescript node module3 vulnerabilities
- crud-file-server node module2 vulnerabilities
- express-cart2 vulnerabilities
- html-janitor node module2 vulnerabilities
- i18next node module2 vulnerabilities
- m-server2 vulnerabilities
- marked node module2 vulnerabilities
- Nextcloud Server2 vulnerabilities
- private_address_check ruby gem2 vulnerabilities
- remarkable node module2 vulnerabilities
- sanitize-html node module2 vulnerabilities
- serve node module2 vulnerabilities
- ws node module2 vulnerabilities
- 11xiaoli node module1 vulnerability
- 22lixian node module1 vulnerability
- 360class.jansenhm node module1 vulnerability
- 626 node module1 vulnerability
- active-support ruby gem1 vulnerability
- adamvr-geoip-lite node module1 vulnerability
- aedes1 vulnerability
- aegir node module1 vulnerability
- aerospike node module1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2017-16008MEDIUM | Cross-Site Scripting in i18nexti18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2. CWE-79Jun 4, 2018 | CVSS6.1v3.0 | EPSS0.863% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-16010MEDIUM | Cross-Site Scripting in i18nexti18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later. CWE-79May 29, 2018 | CVSS6.1v3.0 | EPSS1.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |