GHSA-8J6J-4H2C-C65P Arbitrary Code Execution in require-node

Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body...

PT-2020-21163

Name of the Vulnerable Software and Affected Versions require-node versions prior to 1.3.4 for 1.x require-node versions prior to 2.0.4 for 2.x Description The issue allows for Arbitrary Code Execution due to the failure to sanitize requests to the require-node endpoint. This enables attackers to...

PT-2020-21248

Name of the Vulnerable Software and Affected Versions domokeeper versions all Description The issue allows for Local File Inclusion, where the /plugin/ route passes a GET parameter unsanitized to a require call, returning the output in the server response. This could enable attackers to load...

PT-2020-21150

Name of the Vulnerable Software and Affected Versions larvitbase-www versions affected versions not specified Description The issue concerns an Unintended Require in the package, which exposes an API endpoint. A GET parameter is passed unsanitized to a require call, allowing attackers to execute...

PT-2020-21495

Name of the Vulnerable Software and Affected Versions require-port version 1.0.0 Description The issue concerns malicious code in the require-port package, designed to exploit typing mistakes when installing modules. Upon installation, it downloads and executes a file from a remote server, openin...

GHSA-H44F-769Q-J6PX Malicious Package in requet

All versions of requet typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

PT-2020-21461

Name of the Vulnerable Software and Affected Versions require-ports version 10.4.0 Description The issue concerns a malicious package designed to exploit users who incorrectly type the name of a module to install. When installed, it downloads a file from a remote server, executes it, and opens a...

CVE-2020-9411: Undefined Security Weakness

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This...

PT-2020-4419

Name of the Vulnerable Software and Affected Versions: TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 Description: The issue is related to errors in the authentication request handling mechanism of...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

Code injection

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8128

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

CVE-2020-8129: Improper Control of Generation of Code

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...

PT-2020-19965

Name of the Vulnerable Software and Affected Versions jsreport versions 2.5.0 and earlier Description The issue allows attackers to execute arbitrary code due to unintended require and server-side request forgery vulnerabilities. Recommendations For jsreport versions 2.5.0 and earlier, at the...

CVE-2020-8128: Inclusion of Functionality from Untrusted Control Sphere

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...