Vendor
snyk
16 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Critical 9.8
promise-probe OS command injection vulnerability
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.
-
Critical 9.8
Validation Bypass in schema-inspector
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
-
Critical 9.9CVE-2019-10760 Public exploit
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Critical 9.9
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.