CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7603

CVE-2020-7603 affects the Node.js module closure-compiler-stream (version 0.1.15 and earlier). The root cause is that the argument module’s exports function options parameter in index.js is controllable by users without sanitization, enabling arbitrary command execution. Multiple sources corrobor...

CVE-2020-7603: Improper Neutralization of Special Elements used in an OS Command

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

PT-2020-19649

Name of the Vulnerable Software and Affected Versions closure-compiler-stream versions 0.1.15 and earlier Description The issue allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization. Recommendations For...

Command Injection

Overview closure-compiler-stream is a Streaming interface for closure compiler. Affected versions of this package are vulnerable to Command Injection. The argument options of the exports function in index.js can be controlled by users without any sanitization. PoC var root =...

Cross site request forgery (csrf)

CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request...

CVE-2020-10499

CSRF in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to close any ticket, given the id, via a crafted request...

PT-2020-12169 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to close any ticket, given the id, via a crafted request to the "admin/manage-tickets.php" endpoint. This is made possible by a CSRF flaw. Recommendations:...

CVE-2020-5403

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

CVE-2020-5403

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

Code injection

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...

PT-2020-18459 · Reactor Netty · Reactor Netty Http Server

Name of the Vulnerable Software and Affected Versions: Reactor Netty HttpServer versions 0.9.3 through 0.9.4 Description: The issue is related to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response. Recommendations: For versions 0.9.3 and...

Memory Leaks

socket.io-adapter is vulnerable to memory leak.This occurs because the function Adapter.prototype.del in index.js leaves a room without properly validating the closure of a socket, allowing an attacker to trigger memory leaks by sending the leave signals...

Sandbox bypass vulnerability in script-security

Sandbox protection in script-security could be circumvented through closure default parameter expressions. This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM. These expressions are now subject to sandbox protecti...

CVE-2013-1930

MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...

CVE-2019-0231

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

CVE-2019-0231

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

Information disclosure

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

CVE-2019-0231

CVE-2019-0231 affects Apache MINA: handling of the TLS close_notify does not close the underlying connection, leaving the socket open and potentially allowing the client to receive cleartext data after termination. The vulnerability is documented across multiple sources, including IBM and GHSA re...