Code injection

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input...

CVE-2019-15597

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input...

CVE-2019-15597

CVE-2019-15597 affects the Node.js wrapper package node-df (v0.1.4). The root cause is unsanitized user input being concatenated into a shell command that is executed, enabling an attacker to perform remote code execution (RCE). Several sources explicitly state that all versions are vulnerable du...

Command Injection

Overview All versions of node-df are vulnerable to Command Injection. The package fails to sanitize filenames passed to the file option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. Recommendation No fix is currently available. Consider using an...

Remote Code Execution (RCE)

node-df is vulnerable to remote code execution RCE. The attack exists because it does not sanitize the user input before it was concatenated inside the command parameter for execution, allowing an attacker to inject malicious code through it...

Node.js third-party modules: [node-df] RCE via insecure command concatenation

I would like to report a RCE issue in the node-df module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: node-df version: 0.1.4 npm page: https://www.npmjs.com/package/node-df Module Description node-df abbreviation of disk free is a cross-platform...

df-automotive.de XSS vulnerability

Open Bug Bounty ID: OBB-693045 Description| Value ---|--- Affected Website:| df-automotive.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sei.df.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-632654 Description| Value ---|--- Affected Website:| sei.df.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2018-0496

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 as well as in RTsoft's Dink Smallwood HD / ProtonSDK version before 3.14 allow an attacker to overwrite arbitrary files on the user's system...

df-sportspecialist.it XSS vulnerability

Open Bug Bounty ID: OBB-538196 Description| Value ---|--- Affected Website:| df-sportspecialist.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

df-sportspecialist.it XSS vulnerability

Open Bug Bounty ID: OBB-456141 Description| Value ---|--- Affected Website:| df-sportspecialist.it Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

df-ru.ru XSS vulnerability

Open Bug Bounty ID: OBB-378491 Description| Value ---|--- Affected Website:| df-ru.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

SUSE SLED12 / SLES12 Security Update : coreutils (SUSE-SU-2015:1637-1)

This update for coreutils provides the following fixes : - Fix memory handling error with case insensitive sort using UTF-8. CVE-2015-4041, CVE-2015-4042 - Ensure 'df -a' shows all remote file system entries. - Only suppress remote mounts of separate exports with 'df --total'. - Document that 'df...

SuSE 11.3 Security Update : coreutils (SAT Patch Number 10620)

Coreutils was updated to fix one security issue and one non-security bug. The following vulnerability was fixed : - Commands such as date, touch or using parsedatetime could, when accepting untrusted input, allow an attacker to crash the application or, potentially, execute arbitrary code...

DFLabs PTK Cross-Site Request Forgery Vulnerability

DFLabs PTK is a powerful collection of digital investigative, forensic tools. A cross-site request forgery vulnerability exists in versions of DFLabs PTK prior to 1.0.5, which allows remote attackers to hijack an administrator's or researcher's authentication to trigger a logout request...

coreutils security, bug fix, and enhancement update

8.4-31.0.1 - clean up empty file if cp is failed Orabug 15973168 8.4-31 - adjust the fix for the du bindmounts failure836557 Mon Oct 07 2013 Ondrej Oprala - Fix su retvals once again 8.4-29 - CVE-2013-0221 CVE-2013-0223 CVE-2013-0222 - fix various segmentation faults in sort, uniq and join1015019...

Oracle Linux 5 : kernel (ELSA-2008-0233)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0233 advisory. - Update: fs fix race condition in dnotify Alexander Viro 439758 CVE-2008-1375 - Update: xen ia64: ftp stress test fixes between HVM/Dom0 Tetsu Yamamot...

Nmap NSE net: nfs-statfs

Retrieves disk space statistics and information from a remote NFS share. The output is intended to resemble the output of 'df'. The script will provide pathconf information of the remote NFS if the version used is NFSv3. SYNTAX: nfs-statfs.human: If set to '1' or 'true', shows file sizes in a hum...

[SECURITY] Fedora 14 Update: libguestfs-1.5.23-1

Libguestfs is a library for accessing and modifying guest disk images. Amongst the things this is good for: making batch configuration changes to guests, getting disk used/free statistics see also: virt-df, migrating between virtualization systems see also: virt-p2v, performing partial backups,...

nfs-statfs NSE Script

Retrieves disk space statistics and information from a remote NFS share. The output is intended to resemble the output of df. The script will provide pathconf information of the remote NFS if the version used is NFSv3. Script Arguments nfs-statfs.human If set to 1 or true, shows file sizes in a...