GHSA-G4HJ-R7R3-9RWV OS Command Injection in gulp-scss-lint

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

OS Command Injection in gulp-scss-lint

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

RHEL 7 : python-XStatic-Bootstrap-SCSS (RHSA-2020:5571)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5571 advisory. python-XStatic-Bootstrap-SCSS is the Bootstrap-SCSS JavaScript library packaged for setuptools / pip. Security Fixes: XSS in the data-target...

Moderate: Red Hat Security Advisory: python-XStatic-Bootstrap-SCSS security update

An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat OpenStack Platform 13 Queens. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Command Injection in juanfran/gulp-scss-lint

Overview gulp-scss-lint is a Lint for your .scss files, this package is vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. Proof of Concept by JHU System Security Lab var root =...

Vulnerability of the `exec` function in the gulp-scss-lint package from the NPM package manager, allowing attackers to execute arbitrary commands.

The vulnerability of the exec function in the src/command.js file of the gulp-scss-lint package exists because measures to eliminate special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

gulp-scss-lint injection vulnerability

gulp-scss-lint is a configurable package of code cleaning tools. A security vulnerability exists in gulp-scss-lint 1.0.0 and earlier versions. An attacker can exploit the vulnerability to inject and execute arbitrary commands...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

Code injection

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7601

CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...

@absolunet/nwayo-workflow (>=3.2.0 <=3.3.6), @londondevstudio/gush (>=0.9.0 <=0.10.0) +53 more potentially affected by CVE-2020-7601 via gulp-scss-lint (>=0.1.12 <=1.0.0)

gulp-scss-lint NPM version =0.1.12, =3.2.0, =0.9.0, =1.0.0, =1.1.1, =0.0.27, =0.0.33, =1.0.34, =1.1.54 - fear-core-dev =1.3.2 and more Source cves: CVE-2020-7601 Source advisory: SNYK:JS-GULPSCSSLINT-560114...

@7ninjas/scss-mixins (=1.0.0-alpha3), @afiniti/design-system (>=0.0.1 <=0.0.8) +247 more potentially affected by CVE-2018-14042 via bootstrap (>=4.0.0 <=4.1.1)

bootstrap NPM version =4.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.0.0, =0.0.16, =0.0.1, =1.0.0, =2.0.0-alpha, =2.3.2, =1.0.0, =1.0.3 - @evoxmusic/angular =0.7.5 and more Source cves: CVE-2018-14042 Source advisory: OSV:GHSA-7MVR-5X2G-WFC8...

[SECURITY] Fedora 28 Update: rubygem-sprockets-3.7.2-1.fc28

Sprockets is a Rack-based asset packaging system that concatenates and serv es JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS...

[SECURITY] Fedora 27 Update: rubygem-sprockets-3.7.2-1.fc27

Sprockets is a Rack-based asset packaging system that concatenates and serv es JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS...

[SECURITY] Fedora 20 Update: rubygem-sprockets-2.8.2-5.fc20

Sprockets is a Rack-based asset packaging system that concatenates and serv es JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS...

[SECURITY] Fedora 21 Update: rubygem-sprockets-2.12.1-3.fc21

Sprockets is a Rack-based asset packaging system that concatenates and serv es JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS...

HackerOne: CSS leaks SCSS debug info

Download CSS style sheet referenced from the HTML and do: grep -oP "file.:.?scss" application-facbdb64a504bb08ec272860320e1941.css | sort | uniq As you can see it exposes information about the file system, source CSS files and software used. See enclosed file for a dump of the output of the comma...