Code Injection

Overview lodash.template is a The Lodash method .template exported as a Node.js module. Affected versions of this package are vulnerable to Code Injection due the improper validation of options.variable key names in .template. An attacker can execute arbitrary code at template compilation time by...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js. Remediation There is no fixed version for freediskspace. Credit: John Hopkins Security Labs...

Arbitrary File Read

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Arbitrary File Read. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF. Not...

Arbitrary Code Execution

Overview infraserver is a data server Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load of the package js-yaml instead of its secure replacement , safeLoad. Remediation There is no fixed version for infraserver. References -...

Command Injection

Overview alfred-workflow-nodejs is an Alfred workflow nodejs module Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands by using a semicolon char in any of the key values. PoC var AlfredNode = require'alfred-workflow-nodejs'; var util...

Prototype Pollution

Overview fine-uploader is a npm package for upload. Note: This project is no longer maintained and the the package should be considered deprecated. Affected versions of this package are vulnerable to Prototype Pollution. Given a value such as proto, this value is used by the extend function witho...

Arbitrary Code Execution

Overview access-policy is a package that encodes and decodes policy JSON files for use with web applications. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution. Po...

Arbitrary Code Execution

Overview mosc is an a simple inline object model builder for NodeJS A small port exists for client-side javascript. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to properties argument is executed by the eval function, resulting in code executio...

User Enumeration

Overview Affected versions of this package are vulnerable to User Enumeration wolfSSL 4.3.0 has mulmod code in wceccmulmodex in ecc.c that does not properly resist timing side-channel attacks. Remediation Upgrade wolfssl to version 5.0.0 or higher. References - GitHub Gist - GitHub PR...

Server-side Template Injection (SSTI)

Overview freemarker:freemarker is a FreeMarker is a "template engine"; a generic tool to generate text output based on templates. Affected versions of this package are vulnerable to Server-side Template Injection SSTI. By allowing user input into java.security.ProtectionDomain.getClassLoader,...

Command Injection

Overview apiconnect-cli-plugins is a Plugin for IBM API Connect Developer Toolkit. Affected versions of this package are vulnerable to Command Injection. The argument pluginUri can be controlled by users without any sanitization. PoC var root = require"apiconnect-cli-plugins"; var payload = "&...

Command Injection

Overview adb-driver is a Universal Android USB Driver. Affected versions of this package are vulnerable to Command Injection. The argument command can be controlled by users without any sanitization. PoC var root = require"adb-driver"; root.execADBCommand' & touch Song'; the injection point is...

Command Injection

Overview node-mpv is a wrapper to comfortably use mpv player with node.js. Affected versions of this package are vulnerable to Command Injection. The argument "options" can be controlled by users without any sanitization. PoC var Root = require"node-mpv"; var options = "binary": '" $touch JHU "'...

Command Injection

Overview compass-compile is a Compass wrapper for node.js. Affected versions of this package are vulnerable to Command Injection. The options argument can be controlled by users without any sanitization. PoC var Root = require'compass-compile'; var root = new Root; var options =...

Command Injection

Overview umount is a device in UNIX, do nothing in Windows. Affected versions of this package are vulnerable to Command Injection. The argument device can be controlled by users without any sanitization. PoC var root = require"umount"; var device = '" $touch Song "'; root.umountdevice, function;...

Command Injection

Overview git-add-remote is an API for adding git remotes. Affected versions of this package are vulnerable to Command Injection. The argument name can be controlled by users without any sanitization. PoC var root = require"git-add-remote"; var payload = "& touch Song"; rootpayload,'',function;...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/yi-ge/unzip is a Golang .zip decompress package. This package is a fork from https://github.com/artdarek/go-unzip with added support for Symlinks. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. ZIP Path traversal is...

Cross-site Request Forgery (CSRF)

Overview phppgadmin/phppgadmin is a web-based administration tool for PostgreSQL. It is perfect for PostgreSQL DBAs, newbies, and hosting services. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. Multiple areas within the application allows sensitive actions t...

Insecure Encryption

Overview parsel is a library that allows you to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. In cases where an initialisation vector is not supplied to the encrypt or decrypt call in parsel.rb, the initialisation vector used b...

Insecure Encryption

Overview parsel is a library that allows you to encrypt and decrypt data with a given key. Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key materia...