Command Injection

Overview All versions of package ts-process-promises are affected by a command injection vulnerability. The injection point is located in line 45 in main entry of package in lib/process-promises.js. Recommendation Since there is currently no fix version, discontinue use of the ts-process-promises...

hltc-webapi-master (>=1.0.0 <=1.2.0), verda (>=0.1.0 <=1.2.1) potentially affected by CVE-2020-7784 via ts-process-promises (=1.0.2)

ts-process-promises NPM version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ts-process-promises and may be impacted: - hltc-webapi-master =1.0.0, =0.1.0, =1.2.1 Source cves: CVE-2020-7784 Source advisory: OSV:GHSA-WW4J-C2RQ-47Q8...

GHSA-WW4J-C2RQ-47Q8 Command injection in ts-process-promises

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js...

Command injection in ts-process-promises

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js...

CVE-2020-7784 command_injection

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:...

CVE-2020-7784

CVE-2020-7784 affects all versions of the npm package ts-process-promises. The exposed vulnerability is a command-injection flaw located at line 45 of the main entry lib/process-promises.js. A PoC demonstrates exploitation via requiring ts-process-promises and invoking exec (e.g., a.exec("touch J...

Radarsu Ts-process-promises Command Injection Vulnerability

Radarsu Ts-process-promises is a Javascript-based application for executing shell commands with cached output by the individual developers at Radarsu. Ts-process-promises is vulnerable to a command injection vulnerability with an injection point at line 45 of lib/process-promises.js...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 45 in main entry of package in lib/process-promises.js. PoC var a =require"ts-process-promises"; a.exec"touch JHU",; Remediation There is no fixed version for ts-process-promises...

hltc-webapi-master (>=1.0.0 <=1.2.0), verda (>=0.1.0 <=1.2.1) potentially affected by CVE-2020-7784 via ts-process-promises (=1.0.2)

ts-process-promises NPM version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ts-process-promises and may be impacted: - hltc-webapi-master =1.0.0, =0.1.0, =1.2.1 Source cves: CVE-2020-7784 Source advisory: SNYK:JS-TSPROCESSPROMISES-1048334...

Node.js third-party modules: [vboxmanage.js] Command Injection via insecure command concatenation

I would like to report a Command Injection issue in the vboxmanage.js module. It allows to execute arbitrary commands on the victim's PC. Module module name: vboxmanage.js version: 1.0.6 npm page: https://www.npmjs.com/package/vboxmanage.js Module Description A wrapper for VirtualBox CLI with...

CVE-2017-16040

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

Remote code execution

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2017-16040

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2017-16040

The CVE-2017-16040 issue affects the gfe-sass library, where it downloads resources over HTTP. This enables a man-in-the-middle when an attacker is on the network or between the user and the server to swap the requested resources with malicious copies, potentially causing remote code execution on...

openSUSE Security Update : nodejs6 (openSUSE-2018-444)

This update for nodejs6 fixes the following issues : - Fix some node-gyp permissions - New upstream LTS release 6.14.1 : - Security fixes : + CVE-2018-7160: Fix for inspector DNS rebinding vulnerability bsc1087463 + CVE-2018-7158: Fix for 'path' module regular expression denial of service...

FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)

Google Chrome Releases reports : 62 security fixes in this release : - 826626 Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28 - 827492 Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30 - 813876 High...

chromium-browser: Incorrect handling of promises in V8

An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page...

A2billing 2.x - SQL Injection

A2billing 2.x - SQL Injection Title : A2billing 2.x , Sql injection vulnerability Vulnerable software : A2billing 2.x Author : Ahmed sultan 0x4148 Email : [email protected] Linkedin : https://www.linkedin.com/in/0x4148/ If you're looking for deep technical stuff , overcoming sanitization/hardening...

Async iterators and generators

Streaming fetches are supported in Chrome, Edge, and Safari, and they look a little like this: async function getResponseSizeurl const response = await fetchurl; const reader = response.body.getReader; let total = 0; while true const done, value = await reader.read; if done return total; total +=...

Async iterators and generators

Streaming fetches are supported in Chrome, Edge, and Safari, and they look a little like this: async function getResponseSizeurl const response = await fetchurl; const reader = response.body.getReader; let total = 0; while true const done, value = await reader.read; if done return total; total +=...