154 matches found
CVE-2020-7597
CVE-2020-7597 (codecov-node) affects the npm package codecov-node before 3.6.5. The issue allows remote attackers to execute arbitrary commands because the value passed as part of the gcov-root argument is executed by the exec function in lib/codecov.js. Root cause is an incomplete fix of CVE-202...
CVE-2019-10790
CVE-2019-10790 concerns the taffydb package (taffydb/taffydb.html) where versions up to 2.7.3 are affected. The issue, as described across multiple sources in the connected documents, is that an attacker can forge the internal index used per data item by injecting extra properties into user input. I...
CVE-2019-10790: Exposure of Resource to Wrong Sphere
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found...
CVE-2019-10790
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found...
Node.js third-party modules: [dy-server2] - stored Cross-Site Scripting
I would like to report Stored XSS in dy-server2 It allows to steal session cookies, deface web , execute anything code javascript Module module name: dy-server2 version: dy-server2 npm page: https://www.npmjs.com/package/dy-server2 Module Description 这是一款轻量级http服务器，可用于文件传输，前端项目预览。 Module Stats...
CVE-2019-10783
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input...
CVE-2019-10783
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input...
CVE-2019-10783
The CVE-2019-10783 entry concerns the npm package lsof. Affected versions include 0.0.4 and all later releases, with vulnerability arising from every exported method invoking exec to parse user input, enabling Command Injection. An in-depth Snyk advisory provides a PoC demonstrating exploitation ...
CVE-2019-10783: Improper Neutralization of Special Elements used in an OS Command
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input...
Command injection
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2020-7596
CVE-2020-7596 affects the codecov-node npm module and its code path that processes the gcov-args/gcov-root argument. Multiple connected sources confirm that codecov-node prior to 3.6.5 (and originally up to 3.6.2 for the core CVE-2020-7596 fix) allows remote attackers to execute arbitrary command...
CVE-2020-7596: Improper Neutralization of Special Elements used in an OS Command
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2019-5480
A path traversal vulnerability in = v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders...
CVE-2019-5480: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in = v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders...
CVE-2019-5447
A path traversal vulnerability in = v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders...
CVE-2019-5447
A path traversal vulnerability in = v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders...
CVE-2019-5447
CVE-2019-5447 affects the http-file-server npm module (versions