EUVD-2021-0600

Malware in sbrugna...

GHSA-4RV9-5VC4-88CG Command injection in node-ps

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

@servable/server (>=1.0.0 <=1.11.2), dockertools (=1.8.2) +5 more potentially affected by CVE-2020-7785 via node-ps (=0.0.2)

node-ps NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-ps and may be impacted: - @servable/server =1.0.0, =1.0.0, =1.5.1, =0.2.1, =0.0.3, =0.0.4 - servable-publishable =1.1.0 Source cves: CVE-2020-7785 Source advisory:...

Command injection in node-ps

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

OS Command Injection

node-ps is vulnerable to OS command injection. The vulnerability exists as untrusted input is passed to childProcess.exec is not validated and sanitized...

CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Code injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7785

CVE-2020-7785 affects all versions of the package node-ps . The root cause is a command injection vulnerability at the injection point in line 72 of lib/index.js, where untrusted input can reach childProcess.exec. A PoC demonstrates supplying shell metacharacters via psargs (e.g., {psargs:["& tou...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Neekey node-ps injection vulnerability

Neekey node-ps is a lookup tool from the US-based individual developer Neekey. It is provided to find running processes. An injection vulnerability exists in Neekey node-ps, which stems from a lack of proper validation of user input data in lib/index.js, which is not filtered or does not correctl...

@servable/server (>=1.0.0 <=1.11.2), dockertools (=1.8.2) +5 more potentially affected by CVE-2020-7785 via node-ps (=0.0.2)

node-ps NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-ps and may be impacted: - @servable/server =1.0.0, =1.0.0, =1.5.1, =0.2.1, =0.0.3, =0.0.4 - servable-publishable =1.1.0 Source cves: CVE-2020-7785 Source advisory:...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 72 in lib/index.js. PoC var a =require"node-ps"; a.lookuppsargs:"& touch JHU ",function Remediation There is no fixed version for node-ps. References - NPM Package - Vulnerable...