Lucene search
+L

226 matches found

Github Security Blog
Github Security Blog
•added 2020/12/16 7:25 p.m.•56 views

Command Injection Vulnerability in systeminformation

Impact command injection vulnerability Patches Problem was fixed with a shell string sanitation fix. Please upgrade to version = 4.31.1 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency For more information If you have any...

8.8CVSS8.6AI score0.02745EPSS
SaveExploits0References6Affected Software1
vulnersOsv
vulnersOsv
•added 2020/12/16 7:25 p.m.•3 views

@azteam/monitor (>=1.0.1, <=1.0.9), @best/builder (>=4.0.0-alpha10, <=4.0.0-beta9) +27 more potentially affected by CVE-2020-26274 via systeminformation (>=4.0.9, <=4.31.0)

systeminformation NPM version =4.0.9, =1.0.1, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =0.0.3, =1.1.0, =5.2.0, =5.2.1 and more Source cves: CVE-2020-26274 Source...

8.8CVSS8AI score0.02745EPSS
SaveExploits0
CNNVD
CNNVD
•added 2020/12/16 12:00 a.m.•21 views

Systeminformation Operating System Command Injection Vulnerability

systeminformation is an Npm software library that can obtain information about the operating system. A vulnerability in operating system command injection existed in versions prior to systeminformation npm package version 4.31.1, which stemmed from this issue fixed in version 4.31.1, and fixed a...

8.8CVSS7.3AI score0.02745EPSS
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2020/12/16 12:00 a.m.•0 views

CVE-2020-26274: Improper Neutralization of Special Elements used in an OS Command

In systeminformation npm package before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix...

8.8CVSS5.8AI score0.02745EPSS
SaveExploits0References3
vulnersOsv
vulnersOsv
•added 2020/12/11 5:44 p.m.•2 views

@azteam/monitor (>=1.0.1, <=1.0.9), @best/builder (>=4.0.0-alpha10, <=4.0.0-beta9) +27 more potentially affected by CVE-2020-26274 via systeminformation (>=4.0.9, <=4.31.0)

systeminformation NPM version =4.0.9, =1.0.1, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =0.0.3, =1.1.0, =5.2.0, =5.2.1 and more Source cves: CVE-2020-26274 Source...

8.8CVSS8AI score0.02745EPSS
SaveExploits0
Snyk
Snyk
•added 2020/12/11 5:44 p.m.•7 views

Command Injection

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Command Injection. The sanitizeShellString function does not sanitize quotation marks, which could be leveraged by an attacker to execute arbitrary commands. PoC const si ...

8.8CVSS7.2AI score0.02745EPSS
SaveExploits0References2
OSV
OSV
•added 2020/11/27 8:15 p.m.•14 views

CVE-2020-26245

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

9.8CVSS6.9AI score
SaveExploits0References2
OSV
OSV
•added 2020/11/27 8:15 p.m.•13 views

DEBIAN-CVE-2020-26245

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

9.8CVSS7.3AI score0.02229EPSS
SaveExploits0References1
Prion
Prion
•added 2020/11/27 8:15 p.m.•25 views

Command injection

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

7.5CVSS9.1AI score0.02229EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2020/11/27 7:50 p.m.•39 views

CVE-2020-26245 Prototype Pollution leading to Command Injection in systeminformation

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

8.1CVSS9.3AI score0.02229EPSS
SaveExploits0References2
Debian CVE
Debian CVE
•added 2020/11/27 7:50 p.m.•17 views

CVE-2020-26245

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

9.8CVSS5.8AI score0.02229EPSS
SaveExploits0
CVE
CVE
•added 2020/11/27 7:50 p.m.•114 views

CVE-2020-26245

The CVE concerns the npm package systeminformation (prior to v4.30.5). A Prototype Pollution flaw can lead to Command Injection, with fixes implemented by rewriting shell sanitations to prevent pollution. Affected versions are before 4.30.5; remediation is to upgrade to v4.30.5 (or at least v4.30...

9.8CVSS8.7AI score0.02229EPSS
SaveExploits0References2Affected Software1
OSV
OSV
•added 2020/11/27 4:07 p.m.•50 views

GHSA-4V2W-H9JM-MQJG Prototype Pollution in systeminformation

Impact command injection vulnerability by prototype pollution Patches Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version = 4.30.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are...

8.1CVSS9.5AI score0.02229EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
•added 2020/11/27 4:07 p.m.•59 views

Prototype Pollution in systeminformation

Impact command injection vulnerability by prototype pollution Patches Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version = 4.30.2 Workarounds If you cannot upgrade, be sure to check or sanitize service parameter strings that are...

9.8CVSS3.2AI score0.02229EPSS
SaveExploits0References4Affected Software1
vulnersOsv
vulnersOsv
•added 2020/11/27 4:07 p.m.•3 views

@azteam/monitor (>=1.0.1, <=1.0.9), @best/builder (>=4.0.0-alpha10, <=4.0.0-beta9) +25 more potentially affected by CVE-2020-26245 via systeminformation (>=4.0.9, <=4.27.11)

systeminformation NPM version =4.0.9, =1.0.1, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =0.0.3, =1.1.0, =1.2.3 - @hnordt/sysinfo 0.1.1 and more Source cves:...

9.8CVSS8.6AI score0.02229EPSS
SaveExploits0
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2020/11/27 12:00 a.m.•3 views

CVE-2020-26245: Improper Neutralization of Special Elements used in an OS Command

npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or...

9.8CVSS5.8AI score0.02229EPSS
SaveExploits0References4
CNNVD
CNNVD
•added 2020/11/27 12:00 a.m.•15 views

Systeminformation Operating System Command Injection Vulnerability

systeminformation is an Npm software library that can obtain operating system information. An operating system command injection vulnerability exists in versions prior to npm package systeminformation 4.30.5, which stems from the fact that npm package systeminformation is susceptible to prototype...

9.8CVSS7.3AI score0.02229EPSS
SaveExploits0References3
OSV
OSV
•added 2020/11/26 11:15 a.m.•23 views

CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

7.3CVSS6.7AI score
SaveExploits0References5
NVD
NVD
•added 2020/11/26 11:15 a.m.•27 views

CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

7.5CVSS7.1AI score0.02422EPSS
SaveExploits1References5
OSV
OSV
•added 2020/11/26 11:15 a.m.•13 views

DEBIAN-CVE-2020-7778

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...

7.3CVSS7.1AI score0.02422EPSS
SaveExploits1References1
Rows per page
Query Builder