1680 matches found
@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019073743), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.1-20221008145236) +195 more potentially affected by CVE-2022-36067 via vm2 (>=1.0.1, <=3.9.10)
vm2 NPM version =1.0.1, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2.1.1, =0.1.1, =1.0.0, =0.1.0, =2.0.0-beta.0 and more Source cves:...
PT-2022-4708
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.11 Description The issue is related to insufficient resource control with dynamic management in the vm2 library, allowing a remote attacker to execute arbitrary code by bypassing sandbox protections. The vulnerability...
CVE-2022-36067 vm2 vulnerable to Sandbox Escape before v3.9.11
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of...
@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019073743), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.1-20221008145236) +191 more potentially affected by CVE-2022-25893 via vm2 (>=3.0.0, <=3.9.9)
vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.1, =1.0.0, =0.1.0, =2.0.0-beta.0 and more Source cves: CVE-2022-258...
@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +41 more potentially affected by CVE-2019-10761 via vm2 (>=3.0.0, <=3.6.10)
vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =4.5.201902251314, =5.0.201901071713,...
@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +41 more potentially affected by CVE-2019-10761 via vm2 (>=3.0.0, <=3.6.10)
vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =4.5.201902251314, =5.0.201901071713,...
vm2 before 3.6.11 vulnerable to sandbox escape
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2019-10761
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2019-10761
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
Code injection
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
CVE-2019-10761
CVE-2019-10761 affects vm2 before 3.6.11. A RangeError can be triggered from the host by infinite recursion within the sandbox, allowing the attacker to reference the host’s mainModule and spawn a child_process to execute arbitrary code. Documented exploits/pocs demonstrate sandbox escape and rem...
CVE-2019-10761
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +44 more potentially affected by CVE-2019-10761 via vm2 (>=1.0.1, <=3.6.10)
vm2 NPM version =1.0.1, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =4.5.201902251314, =5.0.201901071713,...
vm2 security vulnerabilities
vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A security vulnerability exists in vm2 prior to 3.6.11, which stems from reaching the stack call limit via infinite...
PT-2022-8075
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.6.11 Description The issue allows an attacker to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then...
CVE-2019-10761: Uncontrolled Recursion
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to arbitrary code execution due to CVE-2021-23555
Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in a Designer flow. IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to CVE-2021-23555. This bulletin provides patch information ...
CVE-2021-38834
easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...
