Malicious code in @weirdorg/dotenv (npm)

Source: amazon-inspector dce94a089c58246a54a1e4496d323c92bb46dac654e1a1403e875292be94b198 Package is a near-verbatim republication of the popular dotenv library same README, API, and file layout under the @weirdorg/dotenv name. The only material divergence from upstream dotenv is in lib/main.js:...

CVE-2019-15714

cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations...

CVE-2019-15714: Improper Limitation of a Pathname to a Restricted Directory

cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations...

PT-2019-14338

Name of the Vulnerable Software and Affected Versions Entropic before 2019-06-13 Description The issue allows for a potential directory traversal attack in certain situations due to the failure to reject / and in command names in the cli/lib/main.js file. Recommendations For versions prior to...