Node.js third-party modules: [samsung-remote] Command injection

I would like to report a command injection vulnerability in the samsung-remote npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: samsung-remote version: 1.2.5 npm page: https://www.npmjs.com/package/samsung-remote Module Descriptio...

whereis npm module command execution vulnerability

The whereis npm module is a module for searching for files in Linux, it is mainly used to search for binary files, man description files, source code files, and so on. A command execution vulnerability exists in versions of the whereis npm module prior to 0.4.1. An attacker can exploit this...

CVE-2018-3772

Concatenating unsanitized user input in the whereis npm module 0.4.1 allowed an attacker to execute arbitrary commands. The whereis module is deprecated and it is recommended to use the which npm module instead...

Cross site scripting

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3772

CVE-2018-3772 affects the npm module “whereis” prior to 0.4.1. The vulnerability arises from concatenating unsanitized user input, enabling an attacker to execute arbitrary commands (remote code execution). The issue is explicit across multiple sources describing command injection in versions bef...

Code injection

mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2018-3746

The pdfinfojs NPM module versions = 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine...

CVE-2018-3746

The pdfinfojs NPM module versions = 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine...

CVE-2018-3746

The CVE-2018-3746 entry covers the pdfinfojs NPM module, where versions

CVE-2016-10541

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...

Code injection

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...

CVE-2016-10541

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...

CVE-2016-10541

CVE-2016-10541 – shell-quote (npm) : The npm module shell-quote, version 1.6.0 and earlier, cannot correctly escape ">" and ", ;, {, } contribute to successful injection, underscoring the need for prompt update and reevaluation of input handling. Monitor for updates and apply the fixed release...

CVE-2016-10541

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape "" and "" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection...

Node.js third-party modules: Privilege escalation allows any user to add an administrator

I would like to report privilege escalation in the npm module express-cart. It allows a normal user to add another user with administrator privileges. Module module name: express-cart version: 1.1.5 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully...

Node.js third-party modules: `https-proxy-agent` passes unsanitized options to Buffer(arg), resulting in DoS and uninitialized memory leak

I would like to report a Buffer allocation vulnerability in https-proxy-agent. In setups where auth argument is user-controlled, it allows to: 1. cause Denial of Service by trivially consuming all the available CPU resources 2. extract uninitialized memory chunks from the server on Node.js This...

ua-parser-js npm module ReDoS

This module exploits a Regular Expression Denial of Service vulnerability in the npm module "ua-parser-js". Server-side applications that use "ua-parser-js" for parsing the browser user-agent string will be vulnerable if they call the "getOS" or "getResult" functions. This vulnerability was fixed...