Malicious code in yandex-cfg-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview yandex-cfg-env is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

CVE-2022-45537

EyouCMS = 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENVLISTURL"...

PT-2023-14693

Name of the Vulnerable Software and Affected Versions EyouCMS versions prior to 1.6.0 Description A reflected-XSS issue was discovered in the article publish component. The issue is related to the cookie ENV GOBACK URL. Recommendations For EyouCMS versions prior to 1.6.0, update to version 1.6.0 ...

CVE-2022-46179 LiuOS vulnerable to Authorization Bypass through User-Controlled Key

LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUBACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest...

The vulnerability of the do_setup_env function in the sshd service of the OpenSSH encryption service allows a hacker to escalate their privileges.

The vulnerability of the dosetupenv function in the sshd service of the OpenSSH encryption service is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

GHSA-W3X5-427H-WFQ6 Spring Boot Admins integrated notifier support allows arbitrary code execution

Impact All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are possibly affected. Patches In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionConte...

CVE-2022-46166

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are affected. Users are advised to upgrade to th...

CVE-2022-46166: Improper Control of Generation of Code

Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are affected. Users are advised to upgrade to th...

Malicious code in bostcs-perset-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7637e5041da1a022478a80dbe5aa9272db6e68ba2bff280a26ff77cb71acdcea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1655 Malicious code in bostcs-perset-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7637e5041da1a022478a80dbe5aa9272db6e68ba2bff280a26ff77cb71acdcea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OS Command Injection

Heroku-env is vulnerable to OS command injection. The vulnerability is due to the function get that executes a shell command with unsanitized user input. An attacker can inject shell code using the app parameter, using the control operator & or && followed by an arbitrary command...

GHSA-JP45-65JW-94MJ heroku-env susceptible to command injection

A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

Code injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

CVE-2020-28437 affects all versions of the npm package heroku-env. The vulnerability is a command-injection flaw in the get() function, with the injection point in lib/get.js which is required by index.js. This allows unsanitized user input to lead to shell execution. Public sources (Veracode, GH...

CVE-2020-28437 Command Injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

CVE-2020-28437

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...

npm heroku-env 命令注入漏洞

npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configuration and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in versions of heroku-env prior to 2.0.2, which stems from the...

npm heroku-env 命令注入漏洞

npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configurations and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in all versions of heroku-env, which stems from the presence of...