8 matches found
node-prompt-here
node-prompt-here 此仓库是 Endor Labs EXPOSURE 的合成演示目标 。 当前状态为故意存在漏洞 （HOT）。EXPOSURE 将针对其报告 HOT 判定。 跟踪的 CVE：CVE-2020-7602（无上游修复；仅通过补偿性控制缓解）。 EXPOSURE 打开的演示 PR 会将规范配置文件替换为加固后的变体，从而打破漏洞利用链——而无需 升级存在漏洞的依赖项。 客户应用修复的工作量为一次点击 （审查 + 合并）。 此仓库并非生产应用。它仅用于支撑 EXPOSURE 的“点击 → 真实 PR 打开”演示，并针对真实的 GitHub 仓库进行。...
CVE-2020-7602
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
sulu-file-system-view-prompt-here (>=1.0.2, <=1.0.4) potentially affected by CVE-2020-7602 via node-prompt-here (1.0.1)
node-prompt-here NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-prompt-here and may be impacted: - sulu-file-system-view-prompt-here =1.0.2, =1.0.4 Source cves: CVE-2020-7602 Source advisory: OSV:GHSA-F8FH-8RGM-227H...
CVE-2020-7602
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
CVE-2020-7602
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
CVE-2020-7602
CVE-2020-7602 relates to node-prompt-here up to version 1.0.1 where the runCommand() in linux/manager.js is invoked by getDevices(), which is tied to index.process.env.NM_CLI. The argument to execSync() is constructed unsafely and controllable by users, enabling arbitrary command execution (OS co...
CVE-2020-7602
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
sulu-file-system-view-prompt-here (>=1.0.2, <=1.0.4) potentially affected by CVE-2020-7602 via node-prompt-here (1.0.1)
node-prompt-here NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-prompt-here and may be impacted: - sulu-file-system-view-prompt-here =1.0.2, =1.0.4 Source cves: CVE-2020-7602 Source advisory: SNYK:JS-NODEPROMPTHERE-560115...