bigrest (>=1.2.5, <=1.5.8), cloudant_boilerplate_nodejs (0.0.2) +18 more potentially affected by CVE-2022-29623 via connect-multiparty (>=2.0.0, <=2.1.1)

connect-multiparty NPM version =2.0.0, =1.2.5, =1.0.1, =1.9.24, =0.6.5, =0.0.3, =0.0.4, =0.0.60, =2.0.2, =3.5.0, =0.6.1, =0.6.217 and more Source cves: CVE-2022-29623 Source advisory: OSV:GHSA-W2XW-44R3-4V9G...

CVE-2022-29623

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report...

CVE-2022-29623

CVE-2022-29623 describes an arbitrary file upload vulnerability in the file upload module of Connect-Multiparty 2.2.0 (Express Connect-Multiparty). The underlying issue allows an attacker to execute arbitrary code by supplying a crafted PDF file. The vulnerability is documented across multiple so...