407 matches found
CVE-2020-7795
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
CVE-2020-7795
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
CVE-2020-28437
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
Command injection
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
Code injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
CVE-2020-7795
CVE-2020-7795 affects the npm package get-npm-package-version prior to 1.0.7. The vulnerability is a command injection flaw exploited via the main function in index.js, enabling arbitrary code execution. Public sources (e.g., Veracode, PSIRT notes) describe the issue as a command injection with i...
CVE-2020-7795 Command Injection
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js...
CVE-2020-28437 Command Injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
CVE-2020-28437
CVE-2020-28437 affects all versions of the npm package heroku-env. The vulnerability is a command-injection flaw in the get() function, with the injection point in lib/get.js which is required by index.js. This allows unsanitized user input to lead to shell execution. Public sources (Veracode, GH...
get-npm-package-version 命令注入漏洞
get-npm-package-version is a package for hoperyy individual developers. It is used to get the npm package version. A command injection vulnerability exists in get-npm-package-version before 1.0.7, which is caused by command injection via the main function in index.js...
Command Injection
xopen is vulnerable to command injection. The vulnerability exists in xopenfilepath function in index.js because the command execution implementation is not properly handled which allows an attacker to inject and execute malicious commands...
Directory Traversal
snyk-broker is vulnerable to directory traversal. The vulnerability exists in exports function in index.js when reading configs which allows an attacker to traverse through the directories to read and write on files...
Command Injection
npm-help is vulnerable to command injection. The vulnerability exists in the export.latestVersion function in index.js which allows an attacker to inject and execute malicious commands...
Command Injection
git-archive is vulnerable to command injection. A local authenticated attacker is able to inject and execute malicious commands through the exports function in index.js...
GHSA-RWVF-C3WM-QM6W ffmpeg-sdk vulnerable to OS Command Injection
A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...
ffmpeg-sdk vulnerable to OS Command Injection
A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...
xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)
A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...
node-import `params` argument can be controlled by users without any sanitization
This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js...
GHSA-74WF-CWJG-9CF2 xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)
A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...