128 matches found
Malicious code in malicious-pre-install-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1741456bb70a37b2485b448c939f1c6bac3387f988e30a89c5ae1516b1610105 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-28782
Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Setup wizard. The patch blocks entry point of the vulnerability...
PT-2022-19230 · Unknown · Contents To Window
Name of the Vulnerable Software and Affected Versions: Contents To Window versions prior to SMR May-2022 Release 1 Description: The issue is related to improper access control, allowing a physical attacker to install a package before the completion of the Setup wizard. This can be exploited by a...
CVE-2022-24932
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard...
compare-eslint-config (>=0.1.0, <=0.1.1) potentially affected by CVE-2020-7629 via install-package (0.1.0)
install-package NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on install-package and may be impacted: - compare-eslint-config =0.1.0, =0.1.1 Source cves: CVE-2020-7629 Source advisory: OSV:GHSA-6M4R-M3GC-H4R5...
OS Command Injection in install-package
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
GHSA-6M4R-M3GC-H4R5 OS Command Injection in install-package
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
[SECURITY] Fedora 34 Update: gnuchess-6.2.7-5.fc34
The gnuchess package contains the GNU chess program. By default, GNU chess uses a curses text-based interface. Alternatively, GNU chess can be used in conjunction with the xboard user interface and the X Window System for play using a graphical chess board. Install the gnuchess package if you wou...
Command injection
A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation, an administrator executes the command...
CVE-2020-0204
In InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time of Check/Time of Use condition. This could lead to local escalation of privilege by allowing a bypass of the initial zip file signature check for an OS update with no additional execution privileges...
CVE-2020-7629
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7629
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7629
CVE-2020-7629 affects install-package up to version 0.4.0 and is a Command Injection vulnerability that allows execution of arbitrary commands via the options argument. The issue is documented across multiple sources (NVD/Red Hat/OSV/GHSA/Snyk) with severity ranging from High to Critical (CVSS v3...
compare-eslint-config (>=0.1.0, <=0.1.1) potentially affected by CVE-2020-7629 via install-package (0.1.0)
install-package NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on install-package and may be impacted: - compare-eslint-config =0.1.0, =0.1.1 Source cves: CVE-2020-7629 Source advisory: SNYK:JS-INSTALLPACKAGE-564267...
PT-2020-19665
Name of the Vulnerable Software and Affected Versions install-package versions 0.4.0 and earlier Description The issue allows execution of arbitrary commands via the options argument, enabling Command Injection attacks. Recommendations For versions 0.4.0 and earlier, consider restricting the use ...
PT-2020-2801
Name of the Vulnerable Software and Affected Versions umount versions 1.1.0 through 1.1.6 install-package versions 1.1.0 through 1.1.6 Description The issue is related to Command Injection. The device argument can be controlled by users without sanitization, allowing the execution of arbitrary...
Command Injection
Overview install-package is a package that installs node modules from JavaScript. Affected versions of this package are vulnerable to Command Injection. The argument options can be controlled by users without any sanitization. PoC var root = require"install-package"; root"", "& touch Song"; Detai...
Umbraco Cloud Code Issue Vulnerability
Umbraco is a Danish company Umbraco a set of C written in open source content management system CMS.Umbraco Cloud is the cloud version of Umbraco. A security vulnerability exists in Umbraco Cloud version 8.5.3. The vulnerability can be exploited by an attacker to upload files and execute code wit...
Umbraco Code Issue Vulnerability
Umbraco is a Danish company Umbraco C written in open source content management system CMS. A security vulnerability exists in Umbraco CMS version 8.5.3. The vulnerability can be exploited by an attacker to upload files and execute code via the Install Package feature...