Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index. An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code...

PT-2021-3901 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Event Tracing service of Microsoft Windows operating systems. It allows an attacker to elevate their...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service DOS. Remediation There is no fixed version for tinyexr...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service DOS. Remediation There is no fixed version for tinyexr...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code. Remediation There is no fixed version for tinyexr. References - GitHub Commit - GitHub Iss...

Command Injection

Overview gitlogplus is a Git log parser for Node.JS Affected versions of this package are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization. PoC by Rafal Janicki 1. Run npm i gitlogplus 2. Run mkdir gi...

Open Redirect

Overview Flask-User is a Customizable User Authorization & User Management: Register, Confirm, Login, Change username/password, Forgot password and more. Affected versions of this package are vulnerable to Open Redirect. When using the makesafeurl function, it is possible to bypass URL validation...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow. A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a stack overflow. Remediation There is no fixed version for podof...

Arbitrary Command Injection

Overview ps-visitor is a Node.js visit command ps aux and kill. Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the...

Arbitrary Command Injection

Overview portkiller is a port killer. Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input...

Arbitrary Command Injection

Overview kill-process-by-name is a Kills all processes by a certain program Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the...

Arbitrary Command Injection

Overview port-killer is a Kills the process running on a given port assuming you have permission to do so Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This...

Arbitrary Command Injection

Overview killing is a Kill Process Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input...

Arbitrary Command Injection

Overview ps-kill is a Kill processes with ease Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exe...

Arbitrary Command Injection

Overview roar-pidusage is a Cross-platform process cpu % and memory usage of a PID — Edit Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible f...

Man-in-the-Middle (MitM)

Overview Affected versions of this package are vulnerable to Man-in-the-Middle MitM due to Missing TLS hostname validation. Remediation There is no fixed version for twitter-stream. References - GitHub Security Advisory - GitHub Security Advisory Credit: Agustin Gianni...

Man-in-the-Middle (MitM)

Overview Affected versions of this package are vulnerable to Man-in-the-Middle MitM due to Missing TLS hostname validation. Remediation There is no fixed version for tweetstream. References - GitHub Security Advisory - GitHub Security Advisory Credit: Agustin Gianni...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 13 in index.js file in export.latestVersion function. PoC: var root = require"npm-help"; var module = "& touch JHU"; root.latestVersionmodule; Remediation There is no fixed versi...

Command Injection

Overview deferred-exec is a tool to run exec commands. Lets you use exec, execFile and spawn in a sane way. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 42 in lib/deferred-exec.js PoC var a = require"deferred-exec"; a" touch JHU ",;...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 9 in index.js. PoC var root = require"ffmpeg-sdk"; root.execute"touch JHU"; Remediation There is no fixed version for ffmpeg-sdk. Credit: JHU System Security Lab...