CVE-2020-28423

This affects all versions of package monorepo-build...

Code injection

This affects all versions of package node-latex-pdf...

npos-ocr 命令注入漏洞

npos-ocr is an OCR tool for npos that uses the tesseract engine. A command injection vulnerability exists in all versions of npos-ocr, which stems from the presence of command injection...

npm heroku-env 命令注入漏洞

npm heroku-env is a package from npm USA. It is used to parse DATABASEURL from heroku configurations and split it into PG environment variables used by psql pgdump pgrestore and nodepostgres. A command injection vulnerability exists in all versions of heroku-env, which stems from the presence of...

curljs 命令注入漏洞

curljs is a Node.js library that wraps curl functionality. A command injection vulnerability exists in all versions of curljs, which stems from the presence of command injection...

npm package node-latex-pdf 命令注入漏洞

The npm package node-latex-pdf is a package for converting latex files to pdf format from the US company npm. A command injection vulnerability exists in all versions of node-latex-pdf, which stems from the presence of command injection...

monorepo 命令注入漏洞

monorepo is a movie homepage source repository from cinematic open source. A command injection vulnerability exists in all versions of monorepo-build, which stems from the presence of command injection...

npm package node-latex-pdf 命令注入漏洞

The npm package node-latex-pdf is a package for converting latex files to pdf format from the US company npm. A command injection vulnerability exists in all versions of node-latex-pdf, which stems from the presence of command injection...

GHSA-VQGR-MFXM-47F3 git-archive vulnerable to Command Injection via exports function

All versions of package git-archive are vulnerable to Command Injection via the exports function...

GHSA-54W4-2F2P-F48H deferred-exec Command Injection vulnerability

A command injection vulnerability affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js...

GHSA-WFVX-FX73-3RFJ markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped...

GHSA-7VRV-5M2H-RJW9 ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...

Honeywell Safety Manager 访问控制错误漏洞

Honeywell Safety Manager is used by Honeywell to minimize accidents, maximize production uptime, reduce compliance costs, and manage plant safety. An access control error vulnerability exists in all versions of Honeywell Safety Manager that stems from the use of the Security Builder protocol, whi...

Xen 资源管理错误漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A resource management error vulnerability...

Sql injection

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2022-34045

Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh...

PT-2022-21982

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 version M30HG4.V5030.191116 Description A hardcoded encryption/decryption key was found in the configuration files of the affected device, specifically at the /etc ro/lighttpd/www/cgi-bin/ExportAllSettings.sh location. This...

CVE-2022-1565

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wpallimportgetgz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary...

CVE-2022-1565

The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wpallimportgetgz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary...

GHSA-4HQ8-JGR8-MW9J grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...