EUVD-2023-0667

Malicious code in bioql PyPI...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

semver-tags is vulnerable to Command Injection via the getGitTagsRemote function

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

GHSA-8H3G-HCWP-6HXQ semver-tags is vulnerable to Command Injection via the getGitTagsRemote function

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

@braira/changelog (>=1.0.0, <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0, <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5, <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: OSV:GHSA-8H3G-HCWP-6HXQ...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

Command injection

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

CVE-2022-25853

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

PT-2023-12822

Name of the Vulnerable Software and Affected Versions semver-tags versions all Description The issue is related to Command Injection via the getGitTagsRemote function due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number ...

CVE-2022-25853: Improper Neutralization of Special Elements used in an OS Command

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization...

semver-tags 安全漏洞

semver-tags is jtrussell's personal developer's tool for obtaining semver tags for repos. A security vulnerability exists in semver-tags, which stems from improper cleaning of user input. An attacker can exploit this vulnerability to perform command injection via the getGitTagsRemote function...

@braira/changelog (>=1.0.0, <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0, <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5, <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: SNYK:JS-SEMVERTAGS-3175612...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. PoC js var r = require"semver-tags" opt = "repoType":"git","repoPath":"";touch EXPLOITED;"" finalCb = console.log ropt,finalCb Remediation There is...