WS-2020-0436

In commit-msg in versions 0.1.0 to 0.2.3 is vulnerable to RCE, via insecure command formatting...

@hashgraph/stablecoin-npm-cli (>=2.0.0, <=4.4.0), @hashgraph/stablecoin-npm-contracts (>=2.0.0, <=4.4.0) +2 more potentially affected by unknown CVE via commit-msg (0.2.3)

commit-msg NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on commit-msg and may be impacted: - @hashgraph/stablecoin-npm-cli =2.0.0, =2.0.0, =2.0.0, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: MEND:WS-2020-0436...

Node.js third-party modules: [commit-msg] RCE via insecure command formatting

I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...

PT-2018-18711

Name of the Vulnerable Software and Affected Versions Synology Note Station versions prior to 2.5.1-0844 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the commit msg parameter...