CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

Security Bulletin: Vulnerability in Node.js affects IBM Process Mining (CVE-2019-5484)

Summary There is a vulnerability in Node.js that could allow a local attacker to launch a symlink attack. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2019-5484 DESCRIPTION: Node.js bower...

6pm (=0.1.0), @absolunet/nwayo-cli (>=1.0.0 <=3.6.1) +1376 more potentially affected by CVE-2019-5484 via bower (>=0.10.0 <=1.8.4)

bower NPM version =0.10.0, =1.0.0, =3.3.0, =0.1.20, =0.16.9, =0.0.4, =0.102.0, =2.0.0-beta.1, =0.0.1, =1.0.4, =1.0.2, =0.1.16, =1.0.0-alpha.0, =1.0.0-alpha.0, =1.0.0, =1.2.3 and more Source cves: CVE-2019-5484 Source advisory: OSV:GHSA-P6MR-PXG4-68HX...

CVE-2019-5484

CVE-2019-5484 – Bower path traversal . Affects Bower up to version 1.8.7; older releases permit writing files to arbitrary locations during extraction of a malicious package via the install command. Root cause is improper validation of extracted paths, enabling directory traversal and arbitrary f...

6pm (=0.1.0), @absolunet/nwayo-cli (>=1.0.0 <=3.6.1) +1330 more potentially affected by CVE-2019-5484 via bower (>=1.1.2 <=1.8.4)

bower NPM version =1.1.2, =1.0.0, =3.3.0, =0.1.20, =0.16.9, =0.0.4, =0.102.0, =2.0.0-beta.1, =0.0.1, =1.0.4, =1.0.2, =0.1.16, =1.0.0-alpha.0, =1.0.0-alpha.0, =1.0.0, =1.2.3 and more Source cves: CVE-2019-5484 Source advisory: SNYK:JS-BOWER-73627...