CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

Security Bulletin: Vulnerability in Node.js affects IBM Process Mining (CVE-2019-5484)

Summary There is a vulnerability in Node.js that could allow a local attacker to launch a symlink attack. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2019-5484 DESCRIPTION: Node.js bower...

@absolunet/nwayo-cli (>=1.0.0, <=3.6.1), @absolunet/nwayo-workflow (>=3.3.0, <=3.6.1) +479 more potentially affected by CVE-2019-5484 via bower (>=1.1.2, <=1.8.4)

bower NPM version =1.1.2, =1.0.0, =3.3.0, =0.1.16-master.20181116180810, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =0.2.44, =1.0.0, =1.1.1, =1.2.1 - @pattern-lab/uikit-workshop 1.0.0-alpha.7 - @pgswe/ics.js 0.1.3 - @pvsundarram/grunt-bower-task 0.4.2 - @rbrlortie/nwayo-cli 1.4.0 - @rbrlortie/nwayo-workflow...

CVE-2019-5484

CVE-2019-5484 – Bower path traversal . Affects Bower up to version 1.8.7; older releases permit writing files to arbitrary locations during extraction of a malicious package via the install command. Root cause is improper validation of extracted paths, enabling directory traversal and arbitrary f...

@absolunet/nwayo-cli (>=1.0.0, <=3.6.1), @absolunet/nwayo-workflow (>=3.3.0, <=3.6.1) +479 more potentially affected by CVE-2019-5484 via bower (>=1.1.2, <=1.8.4)

bower NPM version =1.1.2, =1.0.0, =3.3.0, =0.1.16-master.20181116180810, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =0.2.44, =1.0.0, =1.1.1, =1.2.1 - @pattern-lab/uikit-workshop 1.0.0-alpha.7 - @pgswe/ics.js 0.1.3 - @pvsundarram/grunt-bower-task 0.4.2 - @rbrlortie/nwayo-cli 1.4.0 - @rbrlortie/nwayo-workflow...