CVE-2020-28447 Command Injection

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

CVE-2020-28447

The CVE-2020-28447 entry corresponds to a command-injection vulnerability in the xopen npm package. Affected software: all versions of xopen. Root cause: in xopen(filepath) located in index.js, the code executes OS commands without proper sanitization (injection point at line 14). Impact: enables...

CVE-2020-28435 Command Injection

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2020-28445

CVE-2020-28445 affects the npm-help package. The vulnerability is in the function export.latestVersion() in index.js (line 13), enabling command injection . Multiple sources describe a global impact across all versions and highlight that an attacker can inject and execute commands (as shown in th...

npm-help 命令注入漏洞

npm-help is a package from the Chinese playman.me individual developer. A security vulnerability exists in npm-help, which is caused by a command injection attack in the export.latestVersion function in the index.js file...

PT-2022-8897 · Npm · Npm-Help

Name of the Vulnerable Software and Affected Versions: npm-help affected versions not specified Description: The issue affects the npm-help package, with the injection point located in line 13 of the index.js file, specifically in the export.latestVersion function. Recommendations: At the moment,...

xopen 命令注入漏洞

xopen is a package from Andrew Imm, a personal developer. It provides a very simple Promise API for opening files from Node on Windows, macOS and Linux. A security vulnerability exists in xopen that stems from a command injection attack injection point in the xopenfilepath function in the index.j...

Regular Expression Denial Of Service (ReDoS)

split-html-to-chars is vulnerable to regular expression denial of service. The vulnerability exists in Splitter function in index.js because the html inputs are not properly sanitized due to insufficient regular expression complexity applied when splitting html to letters for animation which allo...

Regular Expression Denial Of Service (ReDoS)

regexfn is vulnerable to regular expression denial of service. The vulnerability exists in isEmail function in index.js because the emails are not properly validated with sufficient regular expression complexity which allows an attacker to send crafted invalid emails causing a denial of service...

Command Injection

git-promise is vulnerable to command injection. The vulnerability exists in index.js due to an inappropriate fix for another vulnerability which allows an attacker to inject and execute arbitrary commands...

OS Command Injection

proctree is vulnerable to OS command injection. The vulnerability exists in the getProcessTree function in index.js due to a lack of sanitization in shell metacharacters which allows attackers to execute arbitrary commands via the fix function...

OS Command Injection

lifion-verify-deps is vulnerable to OS command injection. An attacker can inject and execute malicious commands through the getLatestVersions and getLatestTag functions of index.js by providing a maliciously crafted dependency name to the package.json...

Clamscan vulnerable to command injection

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

GHSA-5V25-XR56-PHPH Clamscan vulnerable to command injection

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

oauth2orize-fprm XSS vulnerability

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

GHSA-P77R-C6M3-GJ2R oauth2orize-fprm XSS vulnerability

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL...

Prototype Pollution

bodymen is vulnerable to prototype pollution. The vulnerability exists in handler function in index.js because the properties of Object.prototype are not properly handled which allows an attacker to inject properties into existing construct prototypes and modify attributes sending a proto payload...

Prototype Pollution

minimist is vulnerable to Prototype Pollution. An attacker can inject properties into existing construct prototypes via the setKey function in the index.js and modify attributes such as proto, constructor, and prototype...

Prototype Pollution

libnested is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the set function in the index.js and modify attributes such as proto, constructor, and prototype...

Prototype Pollution in libnested

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for CVE-2020-28283...