Malicious code in bunyan-commitlint-upgrade-start (npm)

The package bunyan-commitlint-upgrade-start was found to contain malicious code...

CVE-2020-25755

An issue was discovered on Enphase Envoy R3.x and D4.x and other current devices. The upgradestart function in /installer/upgradestart allows remote authenticated users to execute arbitrary commands via the force parameter...

PT-2021-11179

Name of the Vulnerable Software and Affected Versions: Enphase Envoy versions R3.x and D4.x Description: An issue allows remote authenticated users to execute arbitrary commands via the force parameter in the upgrade start function, accessible through the "/installer/upgrade start" API endpoint...