31 matches found
EUVD-2021-0777
Malware in sbrugna...
CVE-2021-3190
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...
Command Injection in async-git
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
GHSA-6QPR-9MC5-7GCH Command Injection in async-git
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
m2345a-atm (>=1.0.0, <=1.0.1), ndsh (>=1.5.1, <=1.5.5) +1 more potentially affected by CVE-2020-28490 via async-git (1.13.0)
async-git NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on async-git and may be impacted: - m2345a-atm =1.0.0, =1.5.1, =1.8.1, =1.9.1 Source cves: CVE-2020-28490 Source advisory: OSV:GHSA-6QPR-9MC5-7GCH...
OS Command Injection
Overview Affected versions of the async-git package allow OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. Recommendation Upgrade to version 1.13.2 or later. References - CVE - GitHub Advisory...
CVE-2020-28490
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
Command injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490
The CVE-2020-28490 entry concerns the npm package async-git prior to version 1.13.2, which is vulnerable to Command Injection via shell meta-characters (back-ticks). The issue is documented across multiple sources (GHSA, OSV, NVD, CVE listings, and Snyk) with the root cause being unsafe construct...
CVE-2020-28490
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490 Command Injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
Omrilotan async-git Parameter Injection Vulnerability
Omrilotan async-git is a Javascript-based code repository that supports interaction with git repositories by the individual developer Omrilotan. A parameter injection vulnerability exists in async-git. The vulnerability originates from allowing shell metacharacters to be injected into git command...
PT-2021-11549
Name of the Vulnerable Software and Affected Versions: async-git versions prior to 1.13.2 Description: The issue concerns Command Injection via shell meta-characters, specifically back-ticks. This can be exploited, for example, through the git.reset function with a malicious input like...
CVE-2020-28490: Improper Neutralization of Special Elements used in an OS Command
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
m2345a-atm (>=1.0.0, <=1.0.1), ndsh (>=1.5.1, <=1.5.5) +1 more potentially affected by CVE-2021-3190 via async-git (1.13.0)
async-git NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on async-git and may be impacted: - m2345a-atm =1.0.0, =1.5.1, =1.8.1, =1.9.1 Source cves: CVE-2021-3190 Source advisory: OSV:GHSA-6C3F-P5WP-34MH...
OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...
GHSA-6C3F-P5WP-34MH OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...