CVE-2017-16126

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. Source IP process.versions process.platform How the module was invoked (test, require, pre-install)

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-161279.8The module pandora-doomsday infects other modules. It's since been unpublished from the registry.CVE-2017-161289.8The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.CVE-2017-161295.9The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed respons CVE-2017-16135.3IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagemen CVE-2017-161307.5exxxxxxxxxxx is an Http eX Frame Google Style JavaScript Guide. exxxxxxxxxxx is vulnerable to a directory traversal issue, giving an attacke CVE-2017-161317.5unicorn-list is a web framework. unicorn-list is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by p CVE-2017-161327.5simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker acces CVE-2017-161337.5goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" CVE-2017-161347.5http_static_simple is an http server. http_static_simple is vulnerable to a directory traversal issue, giving an attacker access to the file CVE-2017-161357.5serverzyy is a static file server. serverzyy is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-161367.5method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client does CVE-2017-161375.3The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes ar