PT-2021-15472

Name of the Vulnerable Software and Affected Versions ffmpegdotjs affected versions not specified Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given to the trimvideo function. This is due to the use of the child process exec function...

PT-2021-15475

Name of the Vulnerable Software and Affected Versions portkiller versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is provided. This is caused by the use of the child process exec function without proper input sanitization...

PT-2021-15476

Name of the Vulnerable Software and Affected Versions roar-pidusage affected versions not specified Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given to the stat function of the package on certain operating systems. This is due to th...

PT-2021-15474

Name of the Vulnerable Software and Affected Versions picotts versions prior to 0.1.1 Description The issue arises when attacker-controlled user input is given to the say function, allowing an attacker to execute arbitrary commands due to the use of the child process exec function without input...

CVE-2021-23348

This affects the package portprocesses before 1.0.5. If attacker-controlled user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

PT-2021-15452

Name of the Vulnerable Software and Affected Versions portprocesses versions prior to 1.0.5 Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given to the killProcess function. This is due to the use of the child process exec function...

Design/Logic Flaw

This affects the package kill-by-port before 0.0.2. If attacker-controlled user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

PT-2021-15463

Name of the Vulnerable Software and Affected Versions kill-by-port versions prior to 0.0.2 Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given to the killByPort function. This is due to the use of the child process exec function withou...

Code Injection in storybookjs/telejson

✍️ Description telejson is a library for teleporting rich data to another place. The telejson.reviver which is used to parse string data back to json structure can be abused to execute arbitrary code when the lazyEval option is set to false i.e., disabled. The root cause is the attackers can...

CVE-2021-23360

This affects the package killport before 1.0.2. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...

PT-2021-15461

Name of the Vulnerable Software and Affected Versions killport versions prior to 1.0.2 Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization. For...

GHSA-3WJ8-VP9H-RM6M total.js Remote Code Execution Vulnerability

total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution RCE via set. PoC js // To be ru...

GHSA-7QMM-Q394-FMCH Command Injection in ps-kill

This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...

GHSA-QC65-CGVR-93P6 Code injection in kill-process-by-name

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

CVE-2021-23359

This affects all versions of package port-killer. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization. Running this PoC will cause the command touch success to be...

PT-2021-15460

Name of the Vulnerable Software and Affected Versions port-killer versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization. For example,...

PT-2021-15457

Name of the Vulnerable Software and Affected Versions ps-kill versions all Description The issue affects the ps-kill package, where an attacker can execute arbitrary commands if attacker-controlled user input is given to the kill function. This is due to the use of the child process exec function...

PT-2021-15458

Name of the Vulnerable Software and Affected Versions kill-process-by-name versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization in the...

Madge vulnerable to command injection

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which, when the .image, .svg or .dot functions are called, is executed by the childprocess.exec function. PoC js const madge = require'madge'; madge'..', graphVizPat...

EulerOS Virtualization 3.0.2.6 : perl (EulerOS-SA-2021-1446)

According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment...