CVE-2021-21315-PoC

CVE-2021-21315-systeminformation 이것은 CVE-2021-21315에 대한 개념 증명Proof of Concept입니다. 이 취약점은 Node.JS용 System Information Librarynpm 패키지 "systeminformation"에 영향을 미칩니다. npmjs.com/systeminformation "si.inetLatency, si.inetChecksite, si.services, si.processLoad에 전달되는 서비스 파라미터를 반드시 확인하거나 정리하세요. 문자열만 허용하고...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray method, which allowlists an array based only on clazz.isArray and does not validate the array's component type. An attacker who...

Command Injection

systeminformation is vulnerable to command injection. An attacker is able to pass a string as an array to bypass validation and execute arbitrary commands through the following functions: inetLatency, inetChecksite, services, processLoad...

CVE-2020-28460 Prototype Pollution

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448...