Command injection

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata function...

Command injection

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function...

Command injection

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest and the createCert functions...

Open redirect

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...

Vulnerabilities fixed in IBM QRadar SIEM

Vulnerabilities have been fixed in the IBM QRadar Data Synchronization App for IBM QRadar SIEM. The vulnerabilities are are in underlying software and libraries, such as Node.js and SQLite. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the...

proctree 操作系统命令注入漏洞

proctree is used to get or display the process tree. A security vulnerability exists in proctree 0.1.1 and earlier versions, which stems from the vulnerability of Node.js packages to a command injection attack that can be exploited by an attacker to remotely execute code on a machine running...

CVE-2021-34080

CVE-2021-34080 describes an OS Command Injection in es128 ssl-utils 1.0.0 for Node.js, where unsanitized shell metacharacters supplied to createCertRequest() and createCert() enable arbitrary command execution. The provided connected documents (Red Hat, Veracode, GitHub advisory GHSA-552J-PV39-F3...

CVE-2021-34080

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest and the createCert functions...

CVE-2021-34082

CVE-2021-34082 describes an OS command injection in the Node.js package proctree (versions up to 0.1.1 and the specific commit 0ac10ae575459457838f14e21d5996f2fa5c7593) where the vulnerable path is the getProcessTree/fix workflow. The root cause, per connected sources, is lack of sanitization of ...

CVE-2021-34082

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function...

CVE-2021-34083

CVE-2021-34083 affects the Node.js package google-it . The issue is in the openInBrowser path (googleIt.js) where the result URL from Google is unsafely concatenated into a shell command, enabling potential remote code execution on the server. Affected versions: up to 1.6.2. The provided document...

CVE-2021-34083

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...

CVE-2021-34084

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata function...

CVE-2021-34084

CVE-2021-34084 is an OS command injection vulnerability affecting Turistforeningen node-s3-uploader up to version 2.0.3 for Node.js. The issue arises in the getMetadata/metadata() flow where untrusted input can be used to construct OS commands, enabling an attacker to execute arbitrary commands o...

Security Bulletin: Multiple Vulnerabilities in Node.js affects IBM Netcool Agile Service Manager

Summary Multiple vulnerabilities in Node.js used by IBM Netcool Agile Service Manager have been identified. Netcool Agile Service Manager has addressed these CVEs. Vulnerability Details CVEID: CVE-2021-3450 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to code injection due to CVE-2022-29078

Summary Node.js module ejs is used by IBM App Connect Enterprise Certified Container for JavaScript templating. All IBM App Connect Enterprise Certified Container DesignerAuthoring operands, and IntegrationServer operands that run Designer flows may be vulnerable to code injection. This bulletin...

Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2021-27290 DESCRIPTION: Node.js ssri...

Important: Red Hat Security Advisory: nodejs:16 security update

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ALSA-2022:4796 Important: nodejs:16 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: npm: npm ci succeeds when package-lock.json doesn't match package.json CVE-2021-43616 For more details about the security issues, including the...

RLSA-2022:4796 Important: nodejs:16 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: npm: npm ci succeeds when package-lock.json doesn't match package.json CVE-2021-43616 For more details about the security issues, including the...