CVE-2020-28447 Command Injection

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

CVE-2020-28435 Command Injection

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2020-28435

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2020-28445

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion function...

CVE-2020-28445

CVE-2020-28445 affects the npm-help package. The vulnerability is in the function export.latestVersion() in index.js (line 13), enabling command injection . Multiple sources describe a global impact across all versions and highlight that an attacker can inject and execute commands (as shown in th...

CVE-2020-7678

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js"...

CVE-2020-28435: Improper Neutralization of Special Elements used in a Command

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...

CVE-2020-28445: Improper Neutralization of Special Elements used in a Command

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion function...

CVE-2020-28447: Improper Neutralization of Special Elements used in a Command

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

PT-2022-8897 · Npm · Npm-Help

Name of the Vulnerable Software and Affected Versions: npm-help affected versions not specified Description: The issue affects the npm-help package, with the injection point located in line 13 of the index.js file, specifically in the export.latestVersion function. Recommendations: At the moment,...

npm-help 命令注入漏洞

npm-help is a package from the Chinese playman.me individual developer. A security vulnerability exists in npm-help, which is caused by a command injection attack in the export.latestVersion function in the index.js file...

xopen 命令注入漏洞

xopen is a package from Andrew Imm, a personal developer. It provides a very simple Promise API for opening files from Node on Windows, macOS and Linux. A security vulnerability exists in xopen that stems from a command injection attack injection point in the xopenfilepath function in the index.j...

CVE-2020-7678: Undefined Security Weakness

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js"...

PT-2022-8891

Name of the Vulnerable Software and Affected Versions ffmpeg-sdk versions all versions Description A command injection issue affects the package. The injection point is located in line 9 in index.js. Recommendations For all versions, consider disabling or restricting access to the vulnerable code...

Regular Expression Denial Of Service (ReDoS)

split-html-to-chars is vulnerable to regular expression denial of service. The vulnerability exists in Splitter function in index.js because the html inputs are not properly sanitized due to insufficient regular expression complexity applied when splitting html to letters for animation which allo...

Regular Expression Denial Of Service (ReDoS)

regexfn is vulnerable to regular expression denial of service. The vulnerability exists in isEmail function in index.js because the emails are not properly validated with sufficient regular expression complexity which allows an attacker to send crafted invalid emails causing a denial of service...

Command Injection

git-promise is vulnerable to command injection. The vulnerability exists in index.js due to an inappropriate fix for another vulnerability which allows an attacker to inject and execute arbitrary commands...

OS Command Injection

proctree is vulnerable to OS command injection. The vulnerability exists in the getProcessTree function in index.js due to a lack of sanitization in shell metacharacters which allows attackers to execute arbitrary commands via the fix function...

OS Command Injection

lifion-verify-deps is vulnerable to OS command injection. An attacker can inject and execute malicious commands through the getLatestVersions and getLatestTag functions of index.js by providing a maliciously crafted dependency name to the package.json...

Clamscan vulnerable to command injection

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...