CVE-2019-10787

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization...

Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities

Summary IBM Event Streams is affected by the following vulnerabilities in the included Node.js runtime shipped. Vulnerability Details CVEID: CVE-2019-10795 DESCRIPTION: Node.js undefsafe module could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a...

CVE-2019-10787

CVE-2019-10787 affects the im-resize Node.js module (v2.3.2 and earlier) and is caused by improper validation of the exec/cmd parameters in index.js, enabling remote code execution via crafted input. CVSS v3.1 base score 9.8 (CRITICAL) with network attack, no user interaction. Remediation: upgrad...