CVE-2020-7673

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...

CVE-2020-7674

CVE-2020-7674 affects access-policy up to version 3.1.0. The vulnerability is caused by user input passed to the template function being executed by eval, enabling arbitrary code execution. Affected component: access-policy encoder/parser. Impact is Arbitary Code Execution with the exact exploita...

CVE-2020-7673

CVE-2020-7673 affects node-extend up to version 0.2.0. The vulnerability arises in the extend(A,B,as,isAargs) function (lib/extend.js) where user input is passed to eval, enabling Arbitrary Code Execution. Affected: node-extend 0.2.0 and earlier. Impact: potential remote code execution with netwo...

CVE-2020-7674: Improper Control of Generation of Code

access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution...

CVE-2020-7673: Improper Control of Generation of Code

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...

CVE-2020-7672: Improper Control of Generation of Code

mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to properties argument is executed by the eval function, resulting in code execution...

CVE-2020-7675: Improper Control of Generation of Code

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution...

Arbitrary Code Execution

Overview node-extend is an extend for node.js. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution. PoC var...

Arbitrary Code Execution

Overview access-policy is a package that encodes and decodes policy JSON files for use with web applications. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution. Po...

CVE-2020-13756: Improper Control of Generation of Code

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors or getSelectorsBySpecificity is called with input from an attacker...

Urban Dictionary: DOM XSS through ads

Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...

MCIR

This is a collection of intentionally vulnerable applications for testing code injection vulnerabilities. The applications are designed to be used in a trusted web environment and should not be published on a production server or exposed to the internet. The applications include: CryptOMG: A...

CVE-2020-10176

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

Sql injection

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

CVE-2020-10176

CVE-2020-10176 affects ASSA ABLOY Yale WIPC-301W devices in the 2.x.2.29–2.x.2.43_p1 range. The issue is described as an evaluation (eval) injection that enables remote command execution through the device’s HTTP API. The NVD entry notes high-severity impact with network attack vector and no user...

CVE-2020-10176

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

PT-2020-11957 · Assa Abloy · Assa Abloy Yale Wipc-301W

Name of the Vulnerable Software and Affected Versions: ASSA ABLOY Yale WIPC-301W versions 2.x.2.29 through 2.x.2.43 p1 Description: The issue allows Eval Injection of commands. Recommendations: For versions 2.x.2.29 through 2.x.2.43 p1, consider disabling the eval function as a temporary workarou...

CVE-2020-10176: Improper Control of Generation of Code

ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43p1 devices allow Eval Injection of commands...

GHSA-RC77-XXQ6-4MFF Command Injection in hot-formula-parser

Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands...

Huawei EulerOS: Security Advisory for perl (EulerOS-SA-2020-1527)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...