400 matches found
Command Injection
Overview geojson2kml is a node.js module for converting geojson to kml Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function Remediation There is no fixed version for geojson2kml. References -...
Noahdess Corenlp-js-prefab Command Injection Vulnerability
Noahdess Corenlp-js-prefab is a codebase for preprocessing text data written in JS by the Noahdess individual developer. A command injection vulnerability exists in Noahdess corenlp-js-prefab, which stems from an injection point located at line 10 in index.js. This depends on a vulnerable package...
Command Injection
Overview connection-tester is a module that tests to check if the connection can be established or host/port reachable for a given host and port. Useful for testing all the connection in your node application at server startup. Affected versions of this package are vulnerable to Command Injection...
Malicious Package
nodetest199 is a malicious package. The package contains malicious code in index.js which sends local environment variables to a remote server. The malicious code does not execute upon installation...
The vulnerability of the _is_clamav_binary function in Index.js, a antivirus scanner called clamscan, allows a malicious user to execute arbitrary commands.
The vulnerability of the isclamavbinary function in Index.js of the antivirus scanner clamscan exists because special elements are not properly neutralized. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
GHSA-HXCC-F52P-WC94 Insecure serialization leading to RCE in serialize-javascript
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". An object such as "foo": /1"/, "bar": "a"@R--0@" was serialized as "foo": /1"/, "bar": "a/1"/, which allows an attacker to escape the bar key. This requires...
OS Command Injection
git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...
marscode path traversal vulnerability
marscode is a file editor for reading, writing, editing and deleting CRUD files. A path traversal vulnerability exists in fs.readFile in the index.js file in marscode all versions, which stems from the program's failure to clean up paths and can be exploited by an attacker to gain unauthorized...
Directory Traversal
fast-http is vulnerable to directory traversal. Lack of path sanitization in the fs.readfile function in index.js allows an attacker to access arbitrary files outside of the web root...
CVE-2020-7682
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...
Design/Logic Flaw
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...
CVE-2020-7687
CVE-2020-7687 affects all versions of the npm package fast-http . The root cause is lack of path sanitization in the path provided to fs.readFile in index.js, enabling a directory traversal vulnerability. Multiple sources (NVD/NVD entry, GitHub advisory GHSA-7PHR-5M9X-RW9Q, OSV, CVE records, Vera...
CVE-2020-7687 Directory Traversal
This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...
CVE-2020-7681
CVE-2020-7681: Directory traversal in marscode due to lack of path sanitization in the file path used by fs.readFile in index.js. Affected: all versions of marscode. The vulnerability allows accessing files outside the intended directory; several sources (GHSA, CNVD, NVD, OSV, PRION, Snyk) confir...
CVE-2020-7682
CVE-2020-7682 concerns all versions of the npm package marked-tree, with no path sanitization in fs.readFile called from index.js. The connected Snyk entry confirms a Directory Traversal vulnerability that can read arbitrary files outside the web root and provides a PoC demonstrating traversal vi...
CVE-2020-7682 Directory Traversal
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...
npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js
A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js."...
npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js
A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js."...
serialize-javascript code issue vulnerability
Verizon serialize-javascript is a package from Verizon that supports serializing JavaScript to JSON supersets. A code issue vulnerability exists in serialize-javascript versions prior to 3.1.0. A remote attacker can use the 'deleteFunctions' function in the index.js file to inject arbitrary code...