4037 matches found
CVE-2021-28110
/exec in TranzWare e-Commerce Payment Gateway TWEC PG before 3.1.27.5 had a vulnerability in its XML parser...
PT-2021-17746
Name of the Vulnerable Software and Affected Versions: TranzWare e-Commerce Payment Gateway TWEC PG versions prior to 3.1.27.5 Description: The issue is related to a vulnerability in the XML parser of the /exec endpoint in TranzWare e-Commerce Payment Gateway TWEC PG. This vulnerability affects...
Input validation
This affects all versions of package port-killer. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...
CVE-2021-23359 Arbitrary Command Injection
This affects all versions of package port-killer. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...
CVE-2021-23359
This affects all versions of package port-killer. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...
PT-2021-15460
Name of the Vulnerable Software and Affected Versions port-killer versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization. For example,...
CVE-2021-23359: Improper Neutralization of Special Elements used in an OS Command
This affects all versions of package port-killer. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...
Arbitrary Command Injection
kill-process-by-name is vulnerable to arbitrary command injection. The vulnerability exists due to the use of the childprocess exec function without input sanitization in the index.js file...
Remote Code Execution (RCE)
ps-kill is vulnerable to remote code execution. The childprocess exec function in index.js file does not sanitize the user-provided data to the kill function, allowing to execute malicious code via var pskill = require'ps-kill'; pskill.kill'$touch success',function;...
CVE-2021-23356
This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...
Design/Logic Flaw
This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...
Input validation
This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...
CVE-2021-23355
CVE-2021-23355 affects all versions of the npm package ps-kill . The vulnerability arises from unsafely passing attacker-controlled input to Node.js’s child_process.exec in the index.js kill function, enabling arbitrary command execution. Proof-of-concept demonstrates invoking a shell command via...
CVE-2021-23355
This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...
CVE-2021-23356
This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...
CVE-2021-23356 Arbitrary Command Injection
This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...
CVE-2021-23356
This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...
OS Command Injection
portkiller is vulnerable to OS command injection. An attacker is able to inject and execute malicious command via the use of the childprocess exec function as it does not sanitize the input...
PT-2021-15458
Name of the Vulnerable Software and Affected Versions kill-process-by-name versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization in the...
