2528 matches found
Command injection
All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
CVE-2022-25853
All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...
CVE-2022-25855
The CVE-2022-25855 entry concerns the npm package create-choo-app3, with a documented Command Injection vulnerability in the devInstall function due to improper user-input sanitization. Multiple connected sources (Red Hat, GHSA, OSV, CNVD, SNYK, CVE lists) confirm the issue affects all versions a...
CVE-2022-25853
CVE-2022-25853 affects the npm package semver-tags. The vulnerability is a Command Injection in getGitTagsRemote caused by improper input sanitization. Exploitation details and a Proof-of-Concept exist (Snyk report shows an input payload that triggers code execution). Several trusted feeds (Verac...
Fedora 37 : binwalk (2023-32eb9d8ee7)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-32eb9d8ee7 advisory. Security fix for CVE-2022-4510 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...
CVE-2022-25916
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function...
Ubuntu: Security Advisory (USN-5835-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-25881
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library...
Huawei EulerOS: Security Advisory for sudo (EulerOS-SA-2023-1296)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-25967
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...
CVE-2022-25967
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only for users who are rendering templates with user-defined data...
Debian: Security Advisory (DLA-3291-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 37 : rust-libgit2-sys0.12 (2023-129fd06006)
The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-129fd06006 advisory. Update bundled libgit2 to version 1.3.2 for the latest security fixes. Neither the 0.12 branch libgit2-sys nor the 1.3 branch of libgit2 branch are still...
CVE-2018-17828 affecting package zziplib for versions less than 0.13.69-8
CVE-2018-17828 affecting package zziplib for versions less than 0.13.69-8. A patched version of the package is available...
SUSE: Security Advisory (SUSE-SU-2023:0172-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GHSA-J8WR-FWF2-VVR9 Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
CVE-2022-25927
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...
Input validation
All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation...