Archive
28 February 2020
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Critical 9.8
OS Command Injection in enpeem
enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization.
-
Critical 9.8
OS Command Injection in giting
giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any validation.
-
Critical 9.8
push-dir Enables OS Command Injection
push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.js#L139". This could be abused by an attacker to inject arbitrary …
-
Critical 9.8
OS Command Injection in serial-number
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
-
Critical 9.8
OS Command Injection and Command Injection in kill-port-process
The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
-
Critical 9.8
Improper Input Validation and Code Injection in pdf-image
Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.