697 matches found
CVE-2019-10776
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
Command injection
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
CVE-2019-10776
CVE-2019-10776 affects the package git-diff-apply prior to v0.22.2. The vulnerability stems from unvalidated input in index.js where a run() command is constructed from a user-controlled remoteUrl, enabling OS command injection. Impact could include remote code execution if untrusted input is sup...
CVE-2019-10776
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
PT-2020-9128
Name of the Vulnerable Software and Affected Versions git-diff-apply versions prior to 0.22.2 Description The issue arises from the execution of the git command with a user-controlled variable called remoteUrl in the "index.js" file. This allows for potential exploitation. Recommendations For...
CVE-2019-10776: Improper Neutralization of Special Elements used in an OS Command
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
CVE-2019-20149 pertains to kind-of v6.0.2 where ctorName in index.js can be overwritten via a crafted payload to alter type-detection results by exploiting a conflicting name (e.g., 'constructor': {'name':'Symbol'}). The IBM QRadar Use Case Manager bulletin (connected doc) aggregates this CVE amo...
CVE-2019-20149: Exposure of Resource to Wrong Sphere
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
PT-2019-5802
Name of the Vulnerable Software and Affected Versions kind-of versions 6.0.0 through 6.0.2 Description The issue is related to insufficient input validation in the kind-of library, which can be exploited by a remote attacker to cause a denial of service. Specifically, the ctorName in index.js of...
Memory Leaks
socket.io-adapter is vulnerable to memory leak.This occurs because the function Adapter.prototype.del in index.js leaves a room without properly validating the closure of a socket, allowing an attacker to trigger memory leaks by sending the leave signals...
CVE-2019-15560
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...
CVE-2019-15560: Improper Neutralization of Special Elements used in an SQL Command
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js...
PT-2019-14276
Name of the Vulnerable Software and Affected Versions OpenSource Table versions prior to 2019-06-14 Description The issue allows SQL injection in the database/index.js file of the Reviews Module. Recommendations For versions prior to 2019-06-14, update the Reviews Module to a version released aft...
PT-2019-13499
Name of the Vulnerable Software and Affected Versions antSword versions prior to 2.1.0 Description The issue is related to self-XSS in the database configuration, which can lead to code execution. This is possible via files such as modules/database/asp/index.js, modules/database/custom/index.js,...
Cross-Site Scripting (XSS)
sanitize-html is vulnerable to cross-site scripting XSS. The opentag function in index.js fails to sanitize HTML attributes when sanitizing HTML tags that have been modified using a custom tag transformation. If an application uses custom tag transformations, and places user input in an HTML...