CVE-2020-7602

CVE-2020-7602 relates to node-prompt-here up to version 1.0.1 where the runCommand() in linux/manager.js is invoked by getDevices(), which is tied to index.process.env.NM_CLI. The argument to execSync() is constructed unsafely and controllable by users, enabling arbitrary command execution (OS co...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7602: Improper Neutralization of Special Elements used in an OS Command

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

sulu-file-system-view-prompt-here (>=1.0.2, <=1.0.4) potentially affected by CVE-2020-7602 via node-prompt-here (1.0.1)

node-prompt-here NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-prompt-here and may be impacted: - sulu-file-system-view-prompt-here =1.0.2, =1.0.4 Source cves: CVE-2020-7602 Source advisory: SNYK:JS-NODEPROMPTHERE-560115...

Command Injection

Overview node-prompt-here is a package to open a console window at given absolute directory. Affected versions of this package are vulnerable to Command Injection. The runCommand is called by getDevices function in file linux/manager.js, which is required by the index. process.env.NMCLI in the fi...

Information Disclosure

github.com/grafana/grafana is vulnerable to information disclosure. The attack is possible because it does not securely store the passwords for data sources, allowing a user with administrative privilege to disclose the passwords by pressing the "Save and test" button within a data source's...

CVE-2020-10106

CVE-2020-10106 affects PHPGurukul Daily Expense Tracker System 1.0. The Red Hat/NVD entries confirm a SQL injection via the email parameter in index.php or register.php, enabling dumping of the MySQL database and bypassing the login prompt. The vulnerability is driven by improper handling of user...

Security Bulletin: Cross-Site Scripting (XSS) vulnerability have been identified on Tool Prompt Configuration page of Tivoli Netcool/OMNIbus WebGUI (CVE-2020-4196)

Summary Fix is available for vulnerability in Cross-Site Scripting XSS affecting Tivoli Netcool/OMNIbus WebGUI Tool Prompt Configuration page CVE-2020-4196. Vulnerability Details CVEID: CVE-2020-4196 DESCRIPTION: IBM Tivoli Netcool/OMNIbusGUI is vulnerable to cross-site scripting. This...

openSUSE Security Update : sudo (openSUSE-2020-244)

This update for sudo fixes the following issues : Security issue fixed : - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed : - Fixed an issue where sudo -l would ask for a password...

Microsoft Surface Hub Security Feature Bypass Vulnerability

Surface Hub is a smart, multi-touch, large-screen collaboration device. Surface Hub has a security feature bypass vulnerability in the input credential prompt. An attacker could exploit the vulnerability to access settings that are accessible to administrators...

openSUSE: Security Advisory for sudo (openSUSE-SU-2020:0244-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0244-1 Security update for sudo

This update for sudo fixes the following issues: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: - Fixed an issue where sudo -l would ask for a password even...

Security update for sudo (important)

openSUSE Security Update: Security update for sudo Announcement ID: openSUSE-SU-2020:0244-1 Rating: important References: 1162202 1162675 Cross-References: CVE-2019-18634 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available. Description...

SUSE SLES12 Security Update : sudo (SUSE-SU-2020:0409-1)

This update for sudo fixes the following issues : Security issue fixed : CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: Fixed an issue where sudo -l would ask for a password even...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2020:0406-1)

This update for sudo fixes the following issues : Security issue fixed : CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: Fixed an issue where sudo -l would ask for a password even...

SUSE-SU-2020:0409-1 Security update for sudo

This update for sudo fixes the following issues: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: - Fixed an issue where sudo -l would ask for a password even...

SUSE-SU-2020:0408-1 Security update for sudo

This update for sudo fixes the following issues: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: - Fixed an issue where sudo -l would ask for a password even...

SUSE-SU-2020:0407-1 Security update for sudo

This update for sudo fixes the following issue: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202...

SUSE-SU-2020:0406-1 Security update for sudo

This update for sudo fixes the following issues: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: - Fixed an issue where sudo -l would ask for a password even...

SUSE SLES12 Security Update : sudo (SUSE-SU-2020:0390-1)

This update for sudo fixes the following issue : Security issue fixed : CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Note that Tenable Network Security has extracted the preceding description block direct...