OS Command Injection in curling

npm package curling before version 1.1.0 is vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization...

GHSA-XMXH-G7WJ-8M4M OS Command Injection in curling

npm package curling before version 1.1.0 is vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization...

Node.js third-party modules: [curling] Remote Code Execution

I would like to report RCE in curling I can bypass the security check for special characters, read / overwrite file Module module name: curling version: 1.1.0 npm page: https://www.npmjs.com/package/curling Module Description A node wrapper for curl with a very simple api. Module Stats 156 weekly...

Command Injection

Overview curling is a node wrapper for curl with a very simple api. Affected versions of this package are vulnerable to Command Injection via the runcommand,cb function. The command argument can be controlled by users without any sanitization. PoC by JHU System Security Lab js var root =...

curling-basel.ch XSS vulnerability

Open Bug Bounty ID: OBB-714655 Description| Value ---|--- Affected Website:| curling-basel.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

ontariocurlingtour.com XSS vulnerability

Open Bug Bounty ID: OBB-583804 Description| Value ---|--- Affected Website:| ontariocurlingtour.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Man-in-the-Middle (MitM)

Moodle is vulnerable to man-in-the-middle MitM attacks. The repository/s3/S3.php does not verify that the host is secure before curling to it. This can allow a malicious user to conduct a MitM attack...

Curling 3D - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Curling 3D published at the 'play' market has multiple vulnerabilities...

Large-Scale Water Holing Attack Campaigns Hitting Key Targets

A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...