Command injection in connection-tester

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection...

GHSA-W5MP-8P8W-MHH8 Command injection in connection-tester

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection...

CVE-2020-7781

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-7781

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-7781 Command Injection

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-28439

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...

Command Injection

Overview geojson2kml is a node.js module for converting geojson to kml Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function Remediation There is no fixed version for geojson2kml. References -...

Noahdess Corenlp-js-prefab Command Injection Vulnerability

Noahdess Corenlp-js-prefab is a codebase for preprocessing text data written in JS by the Noahdess individual developer. A command injection vulnerability exists in Noahdess corenlp-js-prefab, which stems from an injection point located at line 10 in index.js. This depends on a vulnerable package...

Command Injection

Overview connection-tester is a module that tests to check if the connection can be established or host/port reachable for a given host and port. Useful for testing all the connection in your node application at server startup. Affected versions of this package are vulnerable to Command Injection...

Malicious Package

nodetest199 is a malicious package. The package contains malicious code in index.js which sends local environment variables to a remote server. The malicious code does not execute upon installation...

The vulnerability of the _is_clamav_binary function in Index.js, a antivirus scanner called clamscan, allows a malicious user to execute arbitrary commands.

The vulnerability of the isclamavbinary function in Index.js of the antivirus scanner clamscan exists because special elements are not properly neutralized. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

GHSA-HXCC-F52P-WC94 Insecure serialization leading to RCE in serialize-javascript

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". An object such as "foo": /1"/, "bar": "a"@R--0@" was serialized as "foo": /1"/, "bar": "a/1"/, which allows an attacker to escape the bar key. This requires...

OS Command Injection

git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...

marscode path traversal vulnerability

marscode is a file editor for reading, writing, editing and deleting CRUD files. A path traversal vulnerability exists in fs.readFile in the index.js file in marscode all versions, which stems from the program's failure to clean up paths and can be exploited by an attacker to gain unauthorized...

Directory Traversal

fast-http is vulnerable to directory traversal. Lack of path sanitization in the fs.readfile function in index.js allows an attacker to access arbitrary files outside of the web root...

CVE-2020-7682

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

Design/Logic Flaw

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

CVE-2020-7687 Directory Traversal

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js...

CVE-2020-7687

CVE-2020-7687 affects all versions of the npm package fast-http . The root cause is lack of path sanitization in the path provided to fs.readFile in index.js, enabling a directory traversal vulnerability. Multiple sources (NVD/NVD entry, GitHub advisory GHSA-7PHR-5M9X-RW9Q, OSV, CVE records, Vera...