CVE-2020-36381

An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters...

Shenzhim Aaptjs 操作系统命令注入漏洞

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the packageCmd function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

Shenzhim Aaptjs 操作系统命令注入漏洞

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the crunch function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

Shenzhim Aaptjs 操作系统命令注入漏洞

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the remove function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

Shenzhim Aaptjs 操作系统命令注入漏洞

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the dump function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

Shenzhim Aaptjs 操作系统命令注入漏洞

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the add function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

CVE-2021-41110

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de dated 2021-09-30 contains a patch. There are no available workarounds asid...

Docker < 1.3.1 SSL Fallback Vulnerability

Docker is prone to an SSL fallback vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-WJ6H-7CHW-X4H2 Command injection in get-git-data

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...

SUSE-SU-2021:1497-1 Security update for sca-patterns-sle11

This update for sca-patterns-sle11 fixes the following issues: - New regular patterns 1 for version 1.3.1 Special Register Buffer Data Sampling aka CrossTalk CVE-2020-0543 bsc1154824...

CVE-2021-29455 Missing validation of JWT signature in `grassrootza/grassroot-platform`

Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT...

Stored XSS vulnerability in rest-list-parameter

rest-list-parameter 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. rest-list-parameter 1.3.1 no longer identifies a parameter using...

GHSA-46M8-42HM-WVVW Cross-Site Scripting in emojione

Affected versions of emojione are vulnerable to cross-site scripting when user input is passed into the toShort, shortnameToImage, unicodeToImage, and toImage functions. Recommendation Update to version 1.3.1 or later...

PT-2020-15901 · Blubrry · Blubrry Subscribe-Sidebar Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry subscribe-sidebar plugin version 1.3.1 Description: The issue allows for reflected XSS in the subscribe-sidebar.php file. This can be exploited through the status parameter. Recommendations: For version 1.3.1, update to a newer versio...

Security Bulletin: Apache Log4j valunarability found in Network Performance Insight (CVE-2019-17571)

Summary Apache Log4j vulnerability found in Network Performance Insight CVE-2019-17571. Vulnerability Details CVEID: CVE-2019-17571 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization of untrusted data in SocketServer...

Draytek VigorAP910C Information Disclosure Vulnerability

The DrayTek Draytek VigorAP910C is a wireless access point AP from DrayTek Taiwan, China. A security vulnerability exists in the Draytek VigorAP910C version 1.3.1. An attacker can exploit the vulnerability to obtain sensitive information...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

get-git-data injection vulnerability

get-git-data is a package for accessing Git version information. An injection vulnerability exists in get-git-data 1.3.1 and earlier versions, which stems from a lack of proper validation of user input data. A remote attacker can exploit this vulnerability by sending specially crafted parameters ...

CVE-2020-7619

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data...

io.micronaut:micronaut-http-client environment issue vulnerability

Object Computing micronaut is a JVM-based full-stack framework from Object Computing, Inc. It is mainly used to build modular microservices and serverless applications. io.micronaut: micronaut-http-client is one of the HTTP client. An environmental issue vulnerability exists in io.micronaut:...