2698 matches found
OS Command Injection
Overview Affected versions of the async-git package allow OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. Recommendation Upgrade to version 1.13.2 or later. References - CVE - GitHub Advisory...
CVE-2020-11277
Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile...
Race condition
Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile...
CVE-2020-11277
CVE-2020-11277 describes a race condition in Qualcomm/Snapdragon platforms (Compute, Industrial IoT, Mobile) during an async fastrpc session: the fastrpc context can be freed after sending an RPC, creating a potential vulnerability during async processing. The provided sources (Red Hat advisory a...
CVE-2020-11277
Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile...
CVE-2020-28490
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
Command injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490 Command Injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
CVE-2020-28490
The CVE-2020-28490 entry concerns the npm package async-git prior to version 1.13.2, which is vulnerable to Command Injection via shell meta-characters (back-ticks). The issue is documented across multiple sources (GHSA, OSV, NVD, CVE listings, and Snyk) with the root cause being unsafe construct...
CVE-2020-28490: Improper Neutralization of Special Elements used in an OS Command
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...
Omrilotan async-git Parameter Injection Vulnerability
Omrilotan async-git is a Javascript-based code repository that supports interaction with git repositories by the individual developer Omrilotan. A parameter injection vulnerability exists in async-git. The vulnerability originates from allowing shell metacharacters to be injected into git command...
CVE-2021-22132
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...
OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...
m2345a-atm (>=1.0.0, <=1.0.1), ndsh (>=1.5.1, <=1.5.5) +1 more potentially affected by CVE-2021-3190 via async-git (1.13.0)
async-git NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on async-git and may be impacted: - m2345a-atm =1.0.0, =1.5.1, =1.8.1, =1.9.1 Source cves: CVE-2021-3190 Source advisory: OSV:GHSA-6C3F-P5WP-34MH...
GHSA-6C3F-P5WP-34MH OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...
CentOS 8 : gnutls (CESA-2019:3600)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3600 advisory. - gnutls: use-after-free/double-free in certificate verification CVE-2019-3829 - gnutls: invalid pointer access upon receiving async handshake messages...
CVE-2021-3317
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shellexec on the original value of the source parameter...