EUVD-2020-0999

Malware in sbrugna...

GHSA-CWCP-6C48-FM7M Unsafe eval() in summit allows arbitrary code execution

Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver. Recommendation No direct patch is available at this time. Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package author has...

Unsafe eval() in summit allows arbitrary code execution

Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver. Recommendation No direct patch is available at this time. Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package author has...

Summit Remote Code Execution Vulnerability

Summit is a Node.js-based web framework. A security vulnerability exists in Summit 0.1.0 and later versions. The vulnerability can be exploited by an attacker to execute arbitrary code when the framework uses the PouchDB driver...

Design/Logic Flaw

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name...

PT-2018-6051 · Summit +1 · Summit +1

Name of the Vulnerable Software and Affected Versions: Summit versions 0.1.0 and later Description: The issue allows an attacker to execute arbitrary commands via the collection name when using the PouchDB driver in the module. There is no information about the estimated number of potentially...

Command Execution Through Collection Name

summit is vulnerable to command execution. There is an unsafe eval in summit which allows an attacker to execute arbitrary commands through a malicious collection name. This only happens when using the PouchDB driver...

Unsafe eval()

Overview Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver. Recommendation No direct patch is available at this time. Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package...