Arbitrary File Read

Overview @sdscoep/web-review is a npm package which will compile reports consisting of multiple criteria. Affected versions of this package are vulnerable to Arbitrary File Read. It is possible to read arbitrary file by using the "file:///" URI as a url. PoC const webReview =...

Command Injection

Overview sonar-wrapper is a package that wraps SonarQube Scanner as a node module. Affected versions of this package are vulnerable to Command Injection. The injection point is located in lib/sonarRunner.js. PoC var root = require"sonar-wrapper"; var options= 'sonar.projectName':'& touch JHU';...

Command Injection

Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...

Command Injection

Overview lycwed-spritesheetjs is a command-line spritesheet a.k.a. Texture Atlas generator written in Node.js. Affected versions of this package are vulnerable to Command Injection. PoC var spritesheet = require"lycwed-spritesheetjs"; spritesheet"./", fuzz:"& touch 111233 ", ext: "json" , functio...

Command Injection

Overview node-latex-pdf is a package that converts your latex files to pdf format. Affected versions of this package are vulnerable to Command Injection. PoC var a =require"node-latex-pdf"; a"./","& touch JHU",function Remediation There is no fixed version for node-latex-pdf. Credit: JHU System...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the lib/utils.js file, which is required by main entry of the package. Note: CVE-2020-28432 has been retracted because it was found to be invalid. Further investigatio...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...

Command Injection

Overview geojson2kml is a node.js module for converting geojson to kml Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function Remediation There is no fixed version for geojson2kml. References -...

Command Injection

Overview curljs is a package that wraps the functionality of curl into an easy to use node module Affected versions of this package are vulnerable to Command Injection. PoC var a=require"curljs"; a"' & touch JHU '" Remediation There is no fixed version for curljs. Credit: JHU System Security Lab...

Command Injection

Overview s3-kilatstorage is a S3 client for NodeJs 8.X or greater. KilatStorageS3 uses a bash command to run s3cmd which has been configured and connected to the kilatstorage service. You can use this package for Amazon S3 service too. Affected versions of this package are vulnerable to Command...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. PoC var a =require"monorepo-build"; a.build"./","& touch 1111"," & touch shaaaa" Remediation There is no fixed version for monorepo-build. Credit: JHU System Security Lab...

Command Injection

Overview git-archive is a module to take a bare git repo, archive it, and export it as a tarball to a given path Affected versions of this package are vulnerable to Command Injection via the exports function. Remediation There is no fixed version for git-archive. Credit: JHU System Security Lab...

OpenAsset Digital Asset Management SQL Injection

Title: Authenticated blind SQL injection SQLi Product: OpenAsset Digital Asset Management by OpenAsset Vendor Homepage: https://www.openasset.com/ Vulnerable Version: 12.0.19 Cloud 11.2.1 On-premise Fixed Version: 12.0.23 Cloud 11.4.10 On-premise CVE Number: CVE-2020-28860 Author: Jack Misiura fr...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 72 in lib/index.js. PoC var a =require"node-ps"; a.lookuppsargs:"& touch JHU ",function Remediation There is no fixed version for node-ps. References - NPM Package - Vulnerable...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 45 in main entry of package in lib/process-promises.js. PoC var a =require"ts-process-promises"; a.exec"touch JHU",; Remediation There is no fixed version for ts-process-promises...

Command Injection

Overview spritesheet-js is a command-line spritesheet a.k.a. Texture Atlas generator written in node.js. Affected versions of this package are vulnerable to Command Injection. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which...

Debian DLA-2477-1 : jupyter-notebook security update

It was discovered that there was an issue in the 'jupyter-notebook' interactive notebook system where a maliciously-crafted link could redirect the browser to a malicious/spoofed website. For Debian 9 'Stretch', this problem has been fixed in version 4.2.3-4+deb9u2. We recommend that you upgrade...

Directory traversal in development mode handler in Vaadin 14 and 15-17

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. See CWE-20: Improper...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks...

CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3....