400 matches found
UBUNTU-CVE-2022-21222
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...
CVE-2022-21222
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...
css-what 资源管理错误漏洞
css-what is a CSS selector parser. A resource management error vulnerability exists in versions of css-what prior to 2.1.3, which stems from the use of an unsafe regular expression in the reattr variable of index.js...
PT-2022-14933 · Css-What +2 · Css-What +2
Name of the Vulnerable Software and Affected Versions: css-what versions prior to 2.1.3 Description: The issue is related to a Regular Expression Denial of Service ReDoS due to the usage of an insecure regular expression in the re attr variable of index.js. This could be triggered via the parse...
CVE-2022-21222
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...
Hostname Spoofing
parse-url is vulnerable to hostname spoofing. The vulnerability exists because the parseUrl function of index.js does not properly identify the custom user in ssh url and hostname, allowing an attacker to gain sensitive information by redirecting to the malicious urls...
Server-Side Request Forgery (SSRF)
parse-url is vulnerable to server-side request forgery. The vulnerability exists in the parseUrl function in index.js because it doesn't validate url or detect the protocol, resource, pathname and user param properly which allows an attacker to cause an ssrf bypass via a crafted url...
Denial Of Service (DoS)
nitrado.js is vulnerable to regular expression denial of service. The vulnerability exists in index.js due to insufficient regular expression complexity which allows an attacker to crash the system...
Regular Expression Denial Of Service (ReDoS)
uri-template-lite is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the expandRe attribute in index.js, allowing an attacker to crash the application by providing a malicious input through the URI.expand method...
Command Injection
monorepo-build is vulnerable to command injection. The vulnerability exists in the publish function in index.js which allows an attacker to inject and execute arbitrary commands...
Command Injection
get-npm-package-version is vulnerable to command injection. The vulnerability exists because the module.export function of index.js does not properly sanitize the packageName and registry parameters, allowing an attacker to inject and execute malicious code...
heroku-env susceptible to command injection
A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
get-npm-package-version Command Injection vulnerability
The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the main function in index.js...
CVE-2020-28437
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
CVE-2020-7795
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
CVE-2020-7795
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
Code injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
Command injection
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
CVE-2020-7795
CVE-2020-7795 affects the npm package get-npm-package-version prior to 1.0.7. The vulnerability is a command injection flaw exploited via the main function in index.js, enabling arbitrary code execution. Public sources (e.g., Veracode, PSIRT notes) describe the issue as a command injection with i...
