Command Injection

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.

Command Injection

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.

Command Injection

This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.

Prototype Pollution

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.

Prototype Pollution

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

Command Injection

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.

Command Injection

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:

Command Injection

This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js

Command Injection

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.

Command Injection

This affects all versions of package google-cloudstorage-commands.

Command Injection

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.

Command Injection

This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.

Command Injection

This affects all versions of package node-latex-pdf.

Command Injection

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

Command Injection

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.

Command Injection

This affects all versions of package curljs.

Command Injection

This affects all versions of package s3-kilatstorage.

Command Injection

This affects all versions of package monorepo-build.

Command Injection

All versions of package git-archive are vulnerable to Command Injection via the exports function.

CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackers to elevate privileges.