CVE-2022-21186

The CVE-2022-21186 issue affects @acrontum/filesystem-template versions prior to 0.0.2. The root cause is lack of sanitization of the href field in the fetchRepo API on external input, enabling Arbitrary Command Injection. Reported impact is high severity: potential remote code execution with net...

CVE-2022-2257 affecting package vim for versions less than 9.0.0050-2

CVE-2022-2257 affecting package vim for versions less than 9.0.0050-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-25867

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format...

CVE-2020-28423 Command Injection

This affects all versions of package monorepo-build...

CVE-2020-28433 Command Injection

This affects all versions of package node-latex-pdf...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2022-2192)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-github-denisbrodbeck-machineid (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2022-2143)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:2561-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:2566-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5189-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-23451

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack...

CVE-2020-7677

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization...

CVE-2021-23397

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead...

CVE-2020-28446

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js...

Code injection

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link...

Session fixation

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization...

Code injection

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...

CVE-2020-7649 Directory Traversal

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal...

Remote Code Execution Backdoor

wikifaces is vulnerable to a remote code execution backdoor. The use of the package opens up a code execution backdoor, allowing a remote attacker to perform unauthorized actions via injecting malicious inputs through the backdoor...