[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2016-10529":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":10,"cwes":11,"cpes":13,"technologies":16,"references":19,"score":24,"epss_score":25,"epss_percentile":26,"is_kev":10,"cisa_kev_date_added":27,"cisa_kev_due_date":27,"cisa_ssvc":28,"attack_mappings":34,"exploits":35},191753,"CVE-2016-10529","EUVD-2019-0339","No CSRF Validation in droppy\n\nAffected versions of `droppy`  are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.\n\n\n## Recommendation\n\nUpdate to version 3.5.0 or later.","2019-02-18T23:39:00Z",{},false,[12],"CWE-352",[14,15],"cpe:2.3:a:droppy_project:droppy:*:*:*:*:*:node.js:*:*","cpe:2.3:a:droppy:droppy:*:*:*:*:*:*:*:*",[17,18],"Droppy_Project Droppy","Droppy Droppy",[20,21,22,23],"https:\u002F\u002Fnodesecurity.io\u002Fadvisories\u002F91","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2016-10529","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rhvc-x32h-5526","https:\u002F\u002Fwww.npmjs.com\u002Fadvisories\u002F91",0,0.00485,0.40877,null,{"timestamp":27,"automatable":29,"tech_impact":30,"exploitation":31,"cisa_decision":32,"cisa_remediation_timeline":33},"no","partial","none",{},"FSU",[],[]]