2533 matches found
Malicious Package in require-port
Version 1.0.0 of require-port contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoo...
Unintended Require in larvitbase-www
All versions of larvitbase-www are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require call. This allows attackers to execute any .js file in the same folder as the server is running. Recommendation No fix is currently...
GHSA-88H9-FC6V-JCW7 Unintended Require in larvitbase-www
All versions of larvitbase-www are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require call. This allows attackers to execute any .js file in the same folder as the server is running. Recommendation No fix is currently...
Local File Inclusion in domokeeper
All versions of domokeeper are vulnerable to Local File Inclusion. The /plugin/ route passes a GET parameter unsanitized to a require call. It then returns the output of require in the server response. This may allow attackers to load unintended code in the application. It also allows attackers t...
GHSA-CR67-78JR-J94P Local File Inclusion in domokeeper
All versions of domokeeper are vulnerable to Local File Inclusion. The /plugin/ route passes a GET parameter unsanitized to a require call. It then returns the output of require in the server response. This may allow attackers to load unintended code in the application. It also allows attackers t...
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body...
GHSA-8J6J-4H2C-C65P Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the require-node endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body...
PT-2020-21163
Name of the Vulnerable Software and Affected Versions require-node versions prior to 1.3.4 for 1.x require-node versions prior to 2.0.4 for 2.x Description The issue allows for Arbitrary Code Execution due to the failure to sanitize requests to the require-node endpoint. This enables attackers to...
PT-2020-21150
Name of the Vulnerable Software and Affected Versions larvitbase-www versions affected versions not specified Description The issue concerns an Unintended Require in the package, which exposes an API endpoint. A GET parameter is passed unsanitized to a require call, allowing attackers to execute...
PT-2020-21495
Name of the Vulnerable Software and Affected Versions require-port version 1.0.0 Description The issue concerns malicious code in the require-port package, designed to exploit typing mistakes when installing modules. Upon installation, it downloads and executes a file from a remote server, openin...
PT-2020-21248
Name of the Vulnerable Software and Affected Versions domokeeper versions all Description The issue allows for Local File Inclusion, where the /plugin/ route passes a GET parameter unsanitized to a require call, returning the output in the server response. This could enable attackers to load...
GHSA-H44F-769Q-J6PX Malicious Package in requet
All versions of requet typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...
PT-2020-21461
Name of the Vulnerable Software and Affected Versions require-ports version 10.4.0 Description The issue concerns a malicious package designed to exploit users who incorrectly type the name of a module to install. When installed, it downloads a file from a remote server, executes it, and opens a...
CVE-2020-9411: Undefined Security Weakness
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This...
PT-2020-4419
Name of the Vulnerable Software and Affected Versions: TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 Description: The issue is related to errors in the authentication request handling mechanism of...
cubx-http-server (0.4.2), karma-extjs-jasmine-tester (>=1.0.0, <=1.1.3) +5 more potentially affected by CVE-2019-10775 via ecstatic (>=3.1.1, <=3.3.0)
ecstatic NPM version =3.1.1, =1.0.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.1 Source cves: CVE-2019-10775 Source advisory: GHSA-9Q64-MPXX-87FG...
CVE-2020-8128
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...
CVE-2020-8129
An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code...
