CVE-2019-10803

CVE-2019-10803 affects push-dir up to version 0.4.1, enabling OS command injection via unsafely passed argument opt.branch to the git command in index.js (line ~139). Connected sources (Red Hat, OSV, Snyk, Veracode, GHSA) consistently describe arbitrary command execution stemming from lack of val...

CVE-2019-10803

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

CVE-2019-10803

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

@3yourmind/yoco (0.0.2-beta.3), @auto-canary/gh-pages (>=9.16.7-canary.0.b718636d.0, <=11.3.0--canary.2478.87bcf4d47797ed8cc7152538b86fd742d8d19462.0) +7 more potentially affected by CVE-2019-10803 via push-dir (0.4.1)

push-dir NPM version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on push-dir and may be impacted: - @3yourmind/yoco 0.0.2-beta.3 - @auto-canary/gh-pages =9.16.7-canary.0.b718636d.0, =9.17.0, =1.0.0, =0.0.16, =0.0.37, =0.0.1, =0.1.1, =0.7.12 Sour...

PT-2020-9153

Name of the Vulnerable Software and Affected Versions push-dir versions 0.4.1 and earlier Description The issue allows execution of arbitrary commands. Arguments provided as part of the variable opt.branch are not validated before being provided to the git command within index.jsL139. This could ...

CVE-2019-10803: Improper Neutralization of Special Elements used in an OS Command

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

ruby: Unintentional directory traversal by poisoned NULL byte in Dir

It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script...

Moderate: Red Hat Security Advisory: ruby security update

An update for ruby is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact ...

D-Link Multiple Routers HNAP strncmp Incorrect Comparison Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue...

PT-2020-1849

Name of the Vulnerable Software and Affected Versions D-Link DIR-867 versions 1.10B04 D-Link DIR-878 versions 1.10B04 D-Link DIR-882 versions 1.10B04 Description The issue is related to errors in the implementation of the authentication algorithm in the HNAP Private Login component of the D-Link...

PT-2020-1848

Name of the Vulnerable Software and Affected Versions D-Link DIR-867 versions 1.10B04 D-Link DIR-878 versions 1.10B04 D-Link DIR-882 versions 1.10B04 Description The issue is related to errors in handling empty passwords in the HNAP strncmp component of the D-Link DIR-867, DIR-878, and DIR-882...

Remote Command Execution Vulnerability in web server in D-link DIR-823G router firmware

The D-Link DIR-823G is a wireless router. A remote command execution vulnerability exists in the web server in the D-link DIR-823G router firmware. An attacker could exploit this vulnerability by sending a constructed specially crafted POST request to execute arbitrary operating system commands...

Buffer overflow vulnerability in web server in D-link DIR-823G router firmware

The D-Link DIR-823G is a wireless router. A buffer overflow vulnerability exists in the web server in the D-link DIR-823G router firmware. An attacker can exploit this vulnerability to cause a buffer overflow attack...

Remote Command Execution Vulnerability in D-link DIR-823G Router

The D-Link DIR-823G is a wireless router. A remote command execution vulnerability exists in the D-link DIR-823G router. An attacker can exploit this vulnerability to execute arbitrary system commands...

D-Link DIR-842 REVC Buffer Overflow Vulnerability

The D-Link DIR-842 REVC is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the D-Link DIR-842 REVC using firmware version v3.13B09 HOTFIX. The vulnerability originates when a network system or product performs an operation on memory without properly...

CVE-2020-8962

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

CVE-2020-8962

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

Stack overflow

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

CVE-2020-8962

A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint...

CVE-2020-8962

CVE-2020-8962 describes a stack-based buffer overflow in the D-Link DIR-842 REVC, caused by the use of strcpy for LOGINPASSWORD when handling a POST request to the /MTFWU endpoint (firmware v3.13B09 HOTFIX). The provided documents do not explicitly detail the impact beyond the overflow descriptio...