CVE-2017-16088

CVE-2017-16088 Exploit di CVE-2017-16088 https://www.wispwisp.com/?p=559...

apoc (>=2.0.0, <=3.0.0-alpha.0), daum-trends (>=0.1.0, <=0.3.0) +11 more potentially affected by CVE-2017-16088 via safe-eval (0.2.0)

safe-eval NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on safe-eval and may be impacted: - apoc =2.0.0, =0.1.0, =5.2.6, =1.0.0, =5.3.6, =0.1.0, =0.1.1, =0.0.1, =0.11.0, =2.0.2, =0.0.1, =0.0.2 Source cves: CVE-2017-16088 Source advisor...

CVE-2017-16088

creationtimestamp| type| source ---|---|--- 2018-07-18 18:28:10+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-ww6v-677g-p656...

CVE-2017-16088

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox...

CVE-2017-16088

CVE-2017-16088 affects the npm package safe-eval, where un-sanitized input can access Function/constructor.CREATE and escape the sandbox, potentially enabling arbitrary code execution. Documents show a sandbox breakout via the process object and evaluation of process.exit(), confirming an RCE-lik...