CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the "isclamavbinary" function located within "Index.js". It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that...

CVE-2020-7613

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

CVE-2020-7613

CVE-2020-7613 affects clamscan up to 1.2.0 and is caused by a command-injection flaw in the _is_clamav_binary function within Index.js. The vulnerability permits injecting arbitrary commands, but exploitation in documented references notes a prerequisite: a folder must be created with the same co...

CVE-2020-7613: Improper Neutralization of Special Elements used in an OS Command

clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the isclamavbinary function located within Index.js. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that wil...

PT-2020-4064

Name of the Vulnerable Software and Affected Versions: clamscan versions prior to 1.2.1 Description: The issue is related to a Command Injection vulnerability. It is possible to inject arbitrary commands as part of the is clamav binary function located within Index.js. This vulnerability requires...

PT-2020-6963

Name of the Vulnerable Software and Affected Versions Minimist versions 0.2.4 and earlier, 1.2.5 and earlier Description The issue is related to a Prototype Pollution vulnerability via the file index.js, specifically the setKey function. This vulnerability can be exploited if an attacker has...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7606

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

Design/Logic Flaw

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7603

CVE-2020-7603 affects the Node.js module closure-compiler-stream (version 0.1.15 and earlier). The root cause is that the argument module’s exports function options parameter in index.js is controllable by users without sanitization, enabling arbitrary command execution. Multiple sources corrobor...

CVE-2020-7607

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7607

The CVE-2020-7607 issue affects gulp-styledocco up to version 0.0.3, where the options parameter of the exports function in index.js can be controlled by users without sanitization, enabling command execution (OS Command Injection). Exploitation details or in-the-wild status are not provided in t...

CVE-2020-7607: Improper Neutralization of Special Elements used in an OS Command

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...

CVE-2020-7603: Improper Neutralization of Special Elements used in an OS Command

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

PT-2020-1958

Name of the Vulnerable Software and Affected Versions docker-compose-remote-api versions 0.1.4 and earlier Description The issue allows execution of arbitrary commands due to insufficient argument validation. Within 'index.js' of the package, the function execserviceName, cmd, fnStdout, fnStderr,...

PT-2020-19651

Name of the Vulnerable Software and Affected Versions gulp-styledocco versions 0.0.3 and earlier Description The issue allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization. Recommendations For versions...

CVE-2020-7606: Improper Neutralization of Special Elements used in an OS Command

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...