CVE-2021-38834

CVE-2021-38834 affects easy-mock versions 1.5.0 through 1.6.0, where remote attackers can bypass the vm2 sandbox and execute arbitrary system commands via specially crafted JavaScript code. This mode of exploitation is described in the vulnerability descriptions and referenced by an exploit entry...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

easy-mock 安全漏洞

easy-mock is a persistence service. It can quickly generate simulated data and provide visual views. A security vulnerability exists in easy-mock versions 1.5.0 through 1.6.0, which can be exploited by remote attackers to bypass the vm2 sandbox and execute arbitrary system commands via specially...

PT-2025-8568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A subtraction overflow bug has been resolved in the Linux kernel. The issue occurs when hole end is small enough to cause a subtraction overflow, or when addr + 2 min alignment overflows...

GHSA-V39H-QM32-8GWQ Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the Object.prototype. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed whic...

What is OpenAPI ❓ Concept, Examples and Advantages

What is OpenAPI? If there is anything that is growing anything like leaps and bounds then it’s API development and awareness towards API’s security. Whether it’s web API or mobile API, growth is significant in each domain. While we discuss API development, OpenAPI deserves a mention for sure. Thi...

easy-mock 1.6.0 - Remote Code Execution (Authenticated) Exploit

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json import random...

Easy-Mock 1.6.0 Remote Code Execution

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Date: 12/08/2021 Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json...

easy-mock 1.6.0 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Date: 12/08/2021 Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json...

Yapi 远程命令执行漏洞

如何复现此问题 登录注册后，创建一个项目 然后选择设置全局的mock脚本，设置命令为远程访问我的服务器地址。 随后添加接口，访问接口的mock地址 服务器可看到响应如下，远程服务器接受到请求 poc: const sandbox = this const ObjectConstructor = this.constructor const FunctionConstructor = ObjectConstructor.constructor const myfun = FunctionConstructor'return process' const process = myfun...

ASB-A-177561690

In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privilege...

botbuilder (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0), botbuilder-azure (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0) +2 more potentially affected by CVE-2021-1725 via botframework-connector (>=4.10.0, <=4.10.2-rc0)

botframework-connector NPM version =4.10.0, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.2-rc0-preview - botkit-mock 4.10.0 Source cves: CVE-2021-1725 Source advisory: OSV:GHSA-FVCJ-HVFW-7F2V...

CVE-2020-26810

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerc...

CVE-2020-26811

SAP Commerce Cloud Accelerator Payment Mock, versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Reque...

CVE-2020-26810

CVE-2020-26810 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, 2005. An unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL that is processed with no further interaction, causing the SAP Commerce service to become unavailabl...

CVE-2020-26811

CVE-2020-26811 affects SAP Commerce Cloud (Accelerator Payment Mock) versions 1808, 1811, 1905, and 2005. The cited issue is a Server-Side Request Forgery (SSRF) where an unauthenticated attacker can submit a crafted request to a specific SAP Commerce module URL, which is processed without furthe...

Malicious Package in river-mock

All versions of river-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput...

GHSA-2H3X-95C6-885R Malicious Package in river-mock

All versions of river-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput...

Malicious Package in luna-mock

All versions of luna-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that compute...

GHSA-QM4Q-F956-FG64 Malicious Package in luna-mock

All versions of luna-mock contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that compute...