Arbitrary Command Injection

kill-process-by-name is vulnerable to arbitrary command injection. The vulnerability exists due to the use of the childprocess exec function without input sanitization in the index.js file...

CVE-2021-23355

This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...

CVE-2021-23356 Arbitrary Command Injection

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

CVE-2021-23356

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

CVE-2021-23356

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

CVE-2021-23355: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...

PT-2021-15458

Name of the Vulnerable Software and Affected Versions kill-process-by-name versions all Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given. This is due to the use of the child process exec function without input sanitization in the...

CVE-2021-23356: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

PT-2021-15457

Name of the Vulnerable Software and Affected Versions ps-kill versions all Description The issue affects the ps-kill package, where an attacker can execute arbitrary commands if attacker-controlled user input is given to the kill function. This is due to the use of the child process exec function...

Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

CVE-2020-28429

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

Command injection

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

CVE-2020-28429

geojson2kml is vulnerable to Command Injection via the index.js file. Affected software: geojson2kml Node.js module. Root cause: unsafely constructs commands (PoC shows passing shell commands) leading to potential remote code execution. Impact stated in connected docs includes unauthorized access...

CVE-2020-28429

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

CVE-2020-28429 Command Injection

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

Insecure URL Validation

url-parse performs Insecure URL Validation. The vulnerability exists as the unsanitized value of address in index.js could be used to bypass validation checks when used in the browser...

PT-2021-11529

Name of the Vulnerable Software and Affected Versions: nuance-gulp-build-common affected versions not specified Description: The issue concerns Command Injection via the index.js file in the nuance-gulp-build-common package. A proof of concept PoC demonstrates the vulnerability by requiring the...

CVE-2020-28429: Improper Neutralization of Special Elements used in an OS Command

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require"geojson2kml"; a"./","& touch JHU",function...

PT-2021-11530

Name of the Vulnerable Software and Affected Versions: wc-cmd versions all Description: The issue concerns command injection via the index.js file in the wc-cmd package. An example of exploitation is provided using the require function to execute a command, such as touch JHU. Recommendations: For...

nuance-gulp-build-common OS Command Injection Vulnerability

nuance-gulp-build-common is a package for npm. nuance-gulp-build-common suffers from an operating system command injection vulnerability that stems from vulnerability to command injection via the index.js file...