EUVD-2017-0287

Malware in sbrugna...

EUVD-2020-0446

Malware in sbrugna...

CVE-2020-11079

node-dns-sync npm module dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1...

Security Bulletin: IBM Datapower Operations Dashboard could allow remote attacker to execute arbitrary commands on the system CVE-2017-16100

Summary dns-sync is used by the IBM Datapower Operations Dashboard implementation of networking operations Vulnerability Details CVEID:CVE-2017-16100 DESCRIPTION: Node.js dns-sync module could allow a remote attacker to execute arbitrary commands on the system, caused by the improper validation o...

Command Injection in dns-sync

Withdrawn: Duplicate of GHSA-jcw8-r9xm-32c6...

GHSA-C6H2-MPC6-232H Command Injection in dns-sync

Withdrawn: Duplicate of GHSA-jcw8-r9xm-32c6...

OS Command Injection

dns-sync is vulnerable to OS command injection. A remote attacker is able to inject and execute arbitrary OS command via a malicious URL...

node-dns-sync code injection vulnerability

node-dns-sync is a package that synchronizes/blocks DNS resolution from the American developers of Skoranga Software. A code injection vulnerability exists in node-dns-sync version 0.2.0 and earlier. A remote attacker can exploit this vulnerability to execute code...

Design/Logic Flaw

node-dns-sync npm module dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1...

@blitzbank/dashboard (>=0.0.1 <=0.0.2), @bloombox/js-client (=1.1.4) +22 more potentially affected by CVE-2020-11079 via dns-sync (=0.1.3)

dns-sync NPM version =0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on dns-sync and may be impacted: - @blitzbank/dashboard =0.0.1, =0.1.0, =1.0.2, =1.0.1, =1.0.1, =2.2.37, =0.0.1, =0.2.24, =0.0.1, =1.0.0, =2.0.3 and more Source cves: CVE-2020-110...

Command injection in node-dns-sync

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input...

CVE-2020-11079

Summary : CVE-2020-11079 affects the npm package node-dns-sync (dns-sync) up to version 0.2.0. The vulnerability allows execution of arbitrary commands via a vulnerable method when driven by untrusted input, potentially leading to remote code execution. A fix is available in version 0.2.1. Affect...

CVE-2020-11079 command injection fix in node-dns-sync

node-dns-sync npm module dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1...

Command Injection

dns-sync is vulnerable to command injection. Lack of input validation allows an attacker to submit input into resolve method, whcih would allow arbitrary command injection on the system...

Critical severity vulnerability that affects dns-sync

Withdrawn, accidental duplicate publish. The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function...

GHSA-WXVM-FH75-MPGR Critical severity vulnerability that affects dns-sync

Withdrawn, accidental duplicate publish. The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function...

Command Injection in dns-sync

Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve method. Recommendation - Use an alternative dns resolver - Do not allow untrusted input into dns-sync.resolve...

GHSA-JCW8-R9XM-32C6 Command Injection in dns-sync

Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve method. Recommendation - Use an alternative dns resolver - Do not allow untrusted input into dns-sync.resolve...

dns-sync Command Injection Vulnerability

dns-sync is a library used in Node.js that allows to resolve hostnames in a synchronized way. A security vulnerability exists in dns-sync. An attacker can exploit this vulnerability to inject commands with untrusted user input...

CVE-2017-16100

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve method then command injection is possible...