EUVD-2021-0600

Malware in sbrugna...

@servable/server (>=1.0.0 <=1.11.2), dockertools (=1.8.2) +5 more potentially affected by CVE-2020-7785 via node-ps (=0.0.2)

node-ps NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-ps and may be impacted: - @servable/server =1.0.0, =1.0.0, =1.5.1, =0.2.1, =0.0.3, =0.0.4 - servable-publishable =1.1.0 Source cves: CVE-2020-7785 Source advisory:...

Command injection in node-ps

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

GHSA-4RV9-5VC4-88CG Command injection in node-ps

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

OS Command Injection

node-ps is vulnerable to OS command injection. The vulnerability exists as untrusted input is passed to childProcess.exec is not validated and sanitized...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Code injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785

CVE-2020-7785 affects all versions of the package node-ps . The root cause is a command injection vulnerability at the injection point in line 72 of lib/index.js, where untrusted input can reach childProcess.exec. A PoC demonstrates supplying shell metacharacters via psargs (e.g., {psargs:["& tou...

Neekey node-ps injection vulnerability

Neekey node-ps is a lookup tool from the US-based individual developer Neekey. It is provided to find running processes. An injection vulnerability exists in Neekey node-ps, which stems from a lack of proper validation of user input data in lib/index.js, which is not filtered or does not correctl...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 72 in lib/index.js. PoC var a =require"node-ps"; a.lookuppsargs:"& touch JHU ",function Remediation There is no fixed version for node-ps. References - NPM Package - Vulnerable...

@servable/server (>=1.0.0 <=1.11.2), dockertools (=1.8.2) +5 more potentially affected by CVE-2020-7785 via node-ps (=0.0.2)

node-ps NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-ps and may be impacted: - @servable/server =1.0.0, =1.0.0, =1.5.1, =0.2.1, =0.0.3, =0.0.4 - servable-publishable =1.1.0 Source cves: CVE-2020-7785 Source advisory:...