321 matches found
PT-2022-14895 · Unknown · Font-Converter
Name of the Vulnerable Software and Affected Versions: font-converter versions all Description: The issue is related to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child process.exec function. This affects a FontForge wrapper used for conversio...
CVE-2022-21186
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...
Command injection
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...
CVE-2022-21186
The CVE-2022-21186 issue affects @acrontum/filesystem-template versions prior to 0.0.2. The root cause is lack of sanitization of the href field in the fetchRepo API on external input, enabling Arbitrary Command Injection. Reported impact is high severity: potential remote code execution with net...
CVE-2022-21186 Arbitrary Command Injection
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...
CVE-2022-21186
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...
Acrontum filesystem-template 安全漏洞
Acrontum filesystem-template is a filesystem template from the German company Acrontum. A security vulnerability exists in Acrontum filesystem-template versions prior to 0.0.2 that stems from vulnerability to arbitrary command injection...
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The package @acrontum/filesystem-template before 0.0.2 is vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...
PT-2022-14910 · Npm · @Acrontum/Filesystem-Template
Name of the Vulnerable Software and Affected Versions: @acrontum/filesystem-template versions prior to 0.0.2 Description: The issue is related to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input. This allows for potential command...
Arbitrary Command Injection
sharp is vulnerable to arbitrary command injection. An attacker is able to set the value of the PKGCONFIGPATH environment variable in a build environment which allows arbitrary command injection at npm install time...
CVE-2022-29256
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...
CVE-2022-29256 Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...
GHSA-RPJ9-PC39-H8J8 Liferay Portal vulnerable to arbitrary command injection
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors...
GHSA-3X62-X456-Q2VM OS Command Injection in git-pull-or-clone
The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn. However, the outpath parameter passed to it may be a...
Arbitrary Command Injection
Overview @acrontum/filesystem-template is a Filesystem templating engine and project scaffolding tool Affected versions of this package are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input. PoC: js const filesys =...
CVE-2022-0764
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...
CVE-2022-0764
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...
CVE-2022-0764
Strapi (strapi/strapi) is affected by CVE-2022-0764: an OS command injection vulnerability in versions prior to 4.1.0 due to improper sanitization of user input when creating an app via the template CLI argument. Impact is arbitrary command execution with local access. Mitigation: update to 4.1.0...
