CVE-2020-2262: Improper Neutralization of Input During Web Page Generation

Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide report files to the plugin's post-build step...

Stored XSS vulnerability in android-lint

android-lint 2.6 and earlier does not escape the annotation message in tooltips. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide report files to the 'Publish Android Lint results' post-build step. As of publication of this advisory, there i...

Command Injection in juanfran/gulp-scss-lint

Overview gulp-scss-lint is a Lint for your .scss files, this package is vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. Proof of Concept by JHU System Security Lab var root =...

openSUSE: Security Advisory for rust, (openSUSE-SU-2020:0945-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE: Security Advisory for rust, (openSUSE-SU-2020:0933-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Malicious Package

Overview access-lint is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using access-lint...

Shift Well-Architecture Left. By Extension, Security Will Follow

A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...

Vulnerability of the `exec` function in the gulp-scss-lint package from the NPM package manager, allowing attackers to execute arbitrary commands.

The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

gulp-scss-lint injection vulnerability

gulp-scss-lint is a configurable package of code cleaning tools. A security vulnerability exists in gulp-scss-lint 1.0.0 and earlier versions. An attacker can exploit the vulnerability to inject and execute arbitrary commands...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

Code injection

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...

CVE-2020-7601: Improper Neutralization of Special Elements used in an OS Command

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

@absolunet/nwayo-workflow (>=3.2.0, <=3.3.6), @londondevstudio/gush (>=0.9.0, <=0.10.0) +53 more potentially affected by CVE-2020-7601 via gulp-scss-lint (>=0.1.12, <=1.0.0)

gulp-scss-lint NPM version =0.1.12, =3.2.0, =0.9.0, =1.0.0-alpha, =1.1.1, =0.0.27, =0.0.33, =1.0.34, =1.1.54 - fear-core-dev 1.3.2 and more Source cves: CVE-2020-7601 Source advisory: SNYK:JS-GULPSCSSLINT-560114...

SUSE SLES12 Security Update : python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer (SUSE-SU-2020:0555-1)

This update for python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, python-jsonpatch, python-jsonpointer, python-scandir, python-PyYAML fixes the...

PT-2020-1960

Name of the Vulnerable Software and Affected Versions gulp-scss-lint versions 1.0.0 and earlier Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands by injecting th...

CVE-2019-1000008

All versions of Helm between Helm =2.0.0 and 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The commands "helm fetch --untar" and "helm lint some.tgz" that can result when chart archive files are unpacked a file may be...