CVE-2020-7681

CVE-2020-7681: Directory traversal in marscode due to lack of path sanitization in the file path used by fs.readFile in index.js. Affected: all versions of marscode. The vulnerability allows accessing files outside the intended directory; several sources (GHSA, CNVD, NVD, OSV, PRION, Snyk) confir...

CVE-2020-7682

CVE-2020-7682 concerns all versions of the npm package marked-tree, with no path sanitization in fs.readFile called from index.js. The connected Snyk entry confirms a Directory Traversal vulnerability that can read arbitrary files outside the web root and provides a PoC demonstrating traversal vi...

CVE-2020-7682 Directory Traversal

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js

A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js."...

npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js

A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js."...

serialize-javascript code issue vulnerability

Verizon serialize-javascript is a package from Verizon that supports serializing JavaScript to JSON supersets. A code issue vulnerability exists in serialize-javascript versions prior to 3.1.0. A remote attacker can use the 'deleteFunctions' function in the index.js file to inject arbitrary code...

CVE-2020-7660

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js"...

CVE-2020-7660

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js"...

Code injection

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js"...

CVE-2020-7660

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js"...

CVE-2020-7660

CVE-2020-7660 affects the serialize-javascript package prior to 3.1.0, where the function named deleteFunctions in index.js can be abused by a remote attacker to inject arbitrary code. The vulnerability enables remote code execution with network access and no authentication, with potential for hi...

Path Traversal

total.js is vulnerable to path traversal attacks. The vulnerability exists in index.js where the blacklisting of %2E in the req.uri.pathname is not done but only %2e , allowing path traversal attacks...

OS Command Injection

clamscan is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands on the system via the isclamavbinary function in index.js...

OS Command Injection

clamscan is vulnerable to OS Command Injection. The vulnerability exists through the isclamavbinary function in index.js...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

Command injection

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

CVE-2020-7613

CVE-2020-7613 affects clamscan up to 1.2.0 and is caused by a command-injection flaw in the _is_clamav_binary function within Index.js. The vulnerability permits injecting arbitrary commands, but exploitation in documented references notes a prerequisite: a folder must be created with the same co...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

PT-2020-6963

Name of the Vulnerable Software and Affected Versions Minimist versions 0.2.4 and earlier, 1.2.5 and earlier Description The issue is related to a Prototype Pollution vulnerability via the file index.js, specifically the setKey function. This vulnerability can be exploited if an attacker has...