Description

`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

Remediation

References

CVE-2017-16044

Related Vulnerabilities

Envoy Proxy Improper Certificate Validation Vulnerability (CVE-2022-21656)

XOOPS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-4433)

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-6356)

MySQL CVE-2018-3058 Vulnerability (CVE-2018-3058)

Oracle JRE CVE-2013-2384 Vulnerability (CVE-2013-2384)

Severity

High

Classification

CVE-2017-16044 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities