EUVD-2021-1230

Malware in sbrugna...

CVE-2017-16034

Affected versions of "pidusage" pass unsanitized input to "childprocess.exec", resulting in arbitrary code execution in the "ps" method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable...

@cicctencent/tars-deploy (>=1.0.1, <=1.0.10), @conga/framework-profiler (>=2.0.0, <=2.0.5) +24 more potentially affected by CVE-2017-16034 via pidusage (>=0.0.4, <=1.1.4)

pidusage NPM version =0.0.4, =1.0.1, =2.0.0, =0.0.1, =1.0.0, =0.0.3, =0.1.0, =0.0.3, =0.0.1, =1.0.0, =0.0.0, =1.2.11, =0.0.3, =0.0.11 and more Source cves: CVE-2017-16034 Source advisory: MEND:CVE-2017-16034...

@cicctencent/tars-deploy (>=1.0.1, <=1.0.10), @conga/framework-profiler (>=2.0.0, <=2.0.5) +12 more potentially affected by CVE-2017-1000220 via pidusage (>=1.0.1, <=1.1.4)

pidusage NPM version =1.0.1, =1.0.1, =2.0.0, =0.0.1, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.1.4-rc.1, =0.1.4 - shady-background 0.0.1 - shady-worker 0.0.4 - trek-status-monitor 0.3.3 - wf-pm2 1.1.3 Source cves: CVE-2017-1000220 Source advisory: OSV:GHSA-H2P3-H48H-9JJ7...

@cicctencent/tars-deploy (>=1.0.1, <=1.0.10), @conga/framework-profiler (>=2.0.0, <=2.0.5) +12 more potentially affected by CVE-2017-1000220 via pidusage (>=1.0.1, <=1.1.4)

pidusage NPM version =1.0.1, =1.0.1, =2.0.0, =0.0.1, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.1.4-rc.1, =0.1.4 - shady-background 0.0.1 - shady-worker 0.0.4 - trek-status-monitor 0.3.3 - wf-pm2 1.1.3 Source cves: CVE-2017-1000220 Source advisory: GHSA-H2P3-H48H-9JJ7...

PIDUsage Enables OS Command Injection

Overview Affected versions of pidusage pass unsanitized input to childprocess.exec, resulting in arbitrary code execution in the ps method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. Proof of Concept js var pid =...

roar-sdk (>=0.1.97, <=0.2.24) potentially affected by CVE-2021-23380 via roar-pidusage (1.1.7)

roar-pidusage NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on roar-pidusage and may be impacted: - roar-sdk =0.1.97, =0.2.24 Source cves: CVE-2021-23380 Source advisory: OSV:GHSA-XFXF-QW26-HR33...

roar-sdk (>=0.1.97, <=0.2.24) potentially affected by CVE-2021-23380 via roar-pidusage (1.1.7)

roar-pidusage NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on roar-pidusage and may be impacted: - roar-sdk =0.1.97, =0.2.24 Source cves: CVE-2021-23380 Source advisory: GHSA-XFXF-QW26-HR33...

GHSA-XFXF-QW26-HR33 Arbitrary command execution in roar-pidusage

This affects all current versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without inpu...

Arbitrary Code Execution

roar-pidusage is vulnerable to arbitrary code execution. The vulnerability exists due to the lack of sanitization of user-provided input which is directly used in the childprocess.exec function...

CVE-2021-23380

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input...

CVE-2021-23380

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input...

CVE-2021-23380: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input...

PT-2021-15476

Name of the Vulnerable Software and Affected Versions roar-pidusage affected versions not specified Description The issue allows an attacker to execute arbitrary commands if attacker-controlled user input is given to the stat function of the package on certain operating systems. This is due to th...

npm roar-pidusage command injection vulnerability

npm roar-pidusage is an application from the American company npm. It is used for cross-platform process cpu% and PID memory usage. roar-pidusage has a security vulnerability that can be exploited by an attacker to potentially execute arbitrary commands. This is due to the use of child processes ...

roar-sdk (>=0.1.97, <=0.2.24) potentially affected by CVE-2021-23380 via roar-pidusage (1.1.7)

roar-pidusage NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on roar-pidusage and may be impacted: - roar-sdk =0.1.97, =0.2.24 Source cves: CVE-2021-23380 Source advisory: SNYK:JS-ROARPIDUSAGE-1078528...

Arbitrary Command Injection

Overview roar-pidusage is a Cross-platform process cpu % and memory usage of a PID — Edit Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible f...

GHSA-HFQ9-RFPV-J8R8 Command Injection in pidusage

Affected versions of pidusage pass unsanitized input to childprocess.exec, resulting in arbitrary code execution in the ps method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. Proof of Concept var pid = require'pidusage';...

@cicctencent/tars-deploy (>=1.0.1, <=1.0.10), @conga/framework-profiler (>=2.0.0, <=2.0.5) +12 more potentially affected by CVE-2017-16034 via pidusage (>=1.0.1, <=1.1.4)

pidusage NPM version =1.0.1, =1.0.1, =2.0.0, =0.0.1, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.1.4-rc.1, =0.1.4 - shady-background 0.0.1 - shady-worker 0.0.4 - trek-status-monitor 0.3.3 - wf-pm2 1.1.3 Source cves: CVE-2017-16034 Source advisory: OSV:GHSA-HFQ9-RFPV-J8R8...

@cicctencent/tars-deploy (>=1.0.1, <=1.0.10), @conga/framework-profiler (>=2.0.0, <=2.0.5) +12 more potentially affected by CVE-2017-16034 via pidusage (>=1.0.1, <=1.1.4)

pidusage NPM version =1.0.1, =1.0.1, =2.0.0, =0.0.1, =0.1.0, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.1.4-rc.1, =0.1.4 - shady-background 0.0.1 - shady-worker 0.0.4 - trek-status-monitor 0.3.3 - wf-pm2 1.1.3 Source cves: CVE-2017-16034 Source advisory: GHSA-HFQ9-RFPV-J8R8...