2196 matches found
GHSA-J8WR-FWF2-VVR9 Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
CVE-2022-25927
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...
Command injection
All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization...
Input validation
All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation...
Command injection
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
CVE-2022-25927
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service ReDoS via the trim function...
Regular Expression Denial of Service (ReDoS)
Overview semver is a semantic version parser used by npm. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range. PoC js const semver = require'semver' const lengths2 = 2000, 4000,...
CVE-2022-21192
All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join...
CVE-2022-25908
CVE-2022-25908 affects the Node.js module create-choo-electron, with all versions vulnerable to Command Injection via the devInstall function due to improper input validation. Connected IBM advisories tie this to IBM Storage Ceph and IBM Maximo MAS deployments, describing feasible command executi...
SUSE SLES12 Security Update : sudo (SUSE-SU-2023:0100-1)
The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:0100-1 advisory. - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions bsc1207082. Tenable has extracted the...
CVE-2022-25901
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service ReDoS via the Cookie.parse function, which uses an insecure regular expression...
CVE-2022-47941 affecting package kernel for versions less than 5.15.86.1-1
CVE-2022-47941 affecting package kernel for versions less than 5.15.86.1-1. A patched version of the package is available...
Debian dla-3267 : libxstream-java - security update
The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3267 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3267-1 [email protected] https://www.debian.org/lts/security/...
CVE-2022-21191
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function...
Command injection
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function...
CVE-2022-24913
CVE-2022-24913 affects com.fasterxml.util:java-merge-sort (versions before 1.1.0). The root cause is an insecure temporary file handling in StdTempFileProvider.java using File.createTempFile(), which can expose temporary file contents (confidentiality impact HIGH). Remediation: upgrade to 1.1.0 o...
Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2023-1183)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-25890
All versions of the package wifey are vulnerable to Command Injection via the connect function due to improper input sanitization...
Huawei EulerOS: Security Advisory for python (EulerOS-SA-2023-1061)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...