CVE-2022-25890

All versions of the package wifey are vulnerable to Command Injection via the connect function due to improper input sanitization...

CVE-2022-25890: Improper Neutralization of Special Elements used in an OS Command

All versions of the package wifey are vulnerable to Command Injection via the connect function due to improper input sanitization...

Command injection

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization...

CVE-2022-25926: Improper Neutralization of Special Elements used in an OS Command

Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization...

CVE-2020-36559

Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the...

CVE-2022-25171

The package p4 before 0.0.7 are vulnerable to Command Injection via the run function due to improper input sanitization...

CVE-2022-25171 Command Injection

The package p4 before 0.0.7 are vulnerable to Command Injection via the run function due to improper input sanitization...

CVE-2022-25171: Improper Neutralization of Special Elements used in an OS Command

The package p4 before 0.0.7 are vulnerable to Command Injection via the run function due to improper input sanitization...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the getFact function due to improper input sanitization. PoC js var root = require"puppet-facter" root.getFact"& touch JHU",function, Remediation There is no fixed version for puppet-facter. References - Vulnerable...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the getRemotePackageInfo function due to improper input sanitization. PoC js var root = require"get-global-packages" root.getRemotePackageInfo"name":"& touch JHU &"...

CVE-2022-41273

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

CVE-2022-41273: URL Redirection to Untrusted Site

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

CVE-2020-36565

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2020-36565

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

Input validation

In Linaro Automated Validation Architecture LAVA before 2022.10, there is dynamic code execution in lavaserver/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server...

Cross-site Scripting (XSS)

Overview vuetify is an a Material Design component framework for Vue.js. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component. Details Cross-site scripting or XSS is a code...

Remote Code Execution

@pendo324/get-process-by-name is vulnerable to remote code execution. The vulnerability exists due to the improper sanitizations of user input passed to the getProcessByName function, which allows remote attackers to inject and execute malicious code...

CVE-2022-31654

VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in configurations...

CVE-2022-25875

The package svelte before 3.49.0 are vulnerable to Cross-site Scripting XSS due to improper input sanitization and to improper escape of attributes when using objects during SSR Server-Side Rendering. Exploiting this vulnerability is possible via objects with a custom toString function...