deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29450
Published: 2021-04-15
Description: Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq; https://lists.debian.org/debian-lts-announce/2021/04/msg00017.html; https://wordpress.org/news/category/security/
CVE: CVE-2021-27691
Published: 2021-04-16
Description: Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-119
References: https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/rkhTCGzMd; https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/rkhTCGzMd
CVE: CVE-2021-27692
Published: 2021-04-16
Description: Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-119
References: https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/ry-t4QfMu; https://hackmd.io/%40aZYpdinUS2SD-yhAeHwOkw/ry-t4QfMu
CVE: CVE-2018-19942
Published: 2021-04-16
Description: A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/qsa-21-04; https://www.qnap.com/zh-tw/security-advisory/qsa-21-04
CVE: CVE-2021-26073
Published: 2021-04-16
Description: Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVSS Score: 7.7 (HIGH)
CWE: CWE-287, CWE-287
References: https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a%5B%E2%80%A6%5Dypass-of-app-qsh-verification-via-context-jwts/47072; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-26074
Published: 2021-04-16
Description: Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072
CVE: CVE-2021-31414
Published: 2021-04-16
Description: The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/LaurentTreguier/vscode-rpm-spec/commit/e19fb8e29cb48cadfd3238371e060d4ffd3384f9; https://vuln.ryotak.me/advisories/36; https://github.com/LaurentTreguier/vscode-rpm-spec/commit/e19fb8e29cb48cadfd3238371e060d4ffd3384f9
CVE: CVE-2021-22539
Published: 2021-04-16
Description: An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.
CVSS Score: 8.2 (HIGH)
CWE: CWE-73, CWE-668
References: https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1; https://github.com/bazelbuild/vscode-bazel/security/advisories/GHSA-2rcw-j8x4-hgcv; https://github.com/bazelbuild/vscode-bazel-ghsa-2rcw-j8x4-hgcv/pull/1
CVE: CVE-2021-20491
Published: 2021-04-16
Description: IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper parameter, an authorized administrator could overflow a buffer and cause the server to crash. IBM X-Force ID: 197792.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197792; https://www.ibm.com/support/pages/node/6442993; https://exchange.xforce.ibmcloud.com/vulnerabilities/197792
CVE: CVE-2020-9667
Published: 2021-04-16
Description: Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker with admin privileges could plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html; https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html
CVE: CVE-2020-9668
Published: 2021-04-16
Description: Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html; https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html
CVE: CVE-2020-9681
Published: 2021-04-16
Description: Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to rewrite the file of the administrator, which may lead to elevated permissions. Exploitation of this issue requires user interaction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html; https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html
CVE: CVE-2021-26830
Published: 2021-04-16
Description: SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://github.com/TribalSystems/Zenario/releases/tag/8.8.53370; https://github.com/TribalSystems/Zenario/releases/tag/8.8.53370
CVE: CVE-2021-29443
Published: 2021-04-16
Description: jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. A possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`. Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4. Thanks to Jason from Microsoft Vulnerability Research (MSVR) for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://github.com/panva/jose/security/advisories/GHSA-58f5-hfqc-jgch; https://www.npmjs.com/package/jose; https://github.com/panva/jose/security/advisories/GHSA-58f5-hfqc-jgch
CVE: CVE-2021-31347
Published: 2021-04-16
Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writing outside a memory region created by mmap).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-91
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html; https://sourceforge.net/p/ezxml/bugs/27/; https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE: CVE-2021-31348
Published: 2021-04-16
Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html; https://sourceforge.net/p/ezxml/bugs/27/; https://lists.debian.org/debian-lts-announce/2021/07/msg00005.html
CVE: CVE-2021-27394
Published: 2021-04-16
Description: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdf
CVE: CVE-2021-29444
Published: 2021-04-16
Description: jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/panva/jose/security/advisories/GHSA-94hh-pjjg-rwmr; https://www.npmjs.com/package/jose-browser-runtime; https://github.com/panva/jose/security/advisories/GHSA-94hh-pjjg-rwmr
CVE: CVE-2021-29445
Published: 2021-04-16
Description: jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/panva/jose/security/advisories/GHSA-4v4g-726h-xvfv; https://www.npmjs.com/package/jose-node-esm-runtime; https://github.com/panva/jose/security/advisories/GHSA-4v4g-726h-xvfv
CVE: CVE-2021-29446
Published: 2021-04-16
Description: jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://github.com/panva/jose/security/advisories/GHSA-rvcw-f68w-8h8h; https://www.npmjs.com/package/jose-node-cjs-runtime; https://github.com/panva/jose/security/advisories/GHSA-rvcw-f68w-8h8h
CVE: CVE-2021-29451
Published: 2021-04-16
Description: Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://github.com/ManyDesigns/Portofino/commit/8c754a0ad234555e813dcbf9e57d637f9f23d8fb; https://github.com/ManyDesigns/Portofino/security/advisories/GHSA-6g3c-2mh5-7q6x; https://mvnrepository.com/artifact/com.manydesigns/portofino
CVE: CVE-2021-29452
Published: 2021-04-16
Description: a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269, CWE-863
References: https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9; https://www.npmjs.com/package/%40curveball/a12n-server; https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9
CVE: CVE-2020-2509
Published: 2021-04-17
Description: A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-21-05; https://www.qnap.com/en/security-advisory/qsa-21-05; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509
CVE: CVE-2020-36195
Published: 2021-04-17
Description: An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-89, CWE-943, CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-21-11; https://www.qnap.com/en/security-advisory/qsa-21-11
CVE: CVE-2021-3492
Published: 2021-04-17
Description: Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (kernel memory exhaustion) or gain privileges via executing arbitrary code. AKA ZDI-CAN-13562.
CVSS Score: 8.8 (HIGH)
CWE: CWE-401, CWE-415, CWE-401, CWE-415
References: http://packetstormsecurity.com/files/162614/Kernel-Live-Patch-Security-Notice-LSN-0077-1.html; https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=25c891a949bf918b59cbc6e4932015ba4c35c333; https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=8fee52ab9da87d82bc6de9ebb3480fff9b4d53e6
CVE: CVE-2021-3493
Published: 2021-04-17
Description: The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-270, CWE-863
References: http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html; http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html
CVE: CVE-2021-23374
Published: 2021-04-18
Description: This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/WisdomKwan/ps-visitor/blob/cdfc934a8e4af95aa0473f4b2a4bd091d09faf2f/index.js%23L404; https://snyk.io/vuln/SNYK-JS-PSVISITOR-1078544; https://github.com/WisdomKwan/ps-visitor/blob/cdfc934a8e4af95aa0473f4b2a4bd091d09faf2f/index.js%23L404
CVE: CVE-2021-23375
Published: 2021-04-18
Description: This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/nrako/psnode/blob/076f623689e4506d3647505daca13b3f482e0c31/lib/index.js%23L59; https://snyk.io/vuln/SNYK-JS-PSNODE-1078543; https://github.com/nrako/psnode/blob/076f623689e4506d3647505daca13b3f482e0c31/lib/index.js%23L59
CVE: CVE-2021-23376
Published: 2021-04-18
Description: This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/TRomesh/ffmpegdotjs/blob/b7395daf0bdcb[PII_REDACTED]7eb7073cdd28462af/index.js%23L219; https://snyk.io/vuln/SNYK-JS-FFMPEGDOTJS-1078542; https://github.com/TRomesh/ffmpegdotjs/blob/b7395daf0bdcb[PII_REDACTED]7eb7073cdd28462af/index.js%23L219
CVE: CVE-2021-23377
Published: 2021-04-18
Description: This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/naddeoa/onion-oled-js/blob/8a523645d2cc29130f98de661b742893773d760d/src/oled-exp.js%23L91; https://snyk.io/vuln/SNYK-JS-ONIONOLEDJS-1078808; https://github.com/naddeoa/onion-oled-js/blob/8a523645d2cc29130f98de661b742893773d760d/src/oled-exp.js%23L91
CVE: CVE-2021-23378
Published: 2021-04-18
Description: This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/luisivan/node-picotts/blob/8c6b183b884890c8e9422f93036b374942398c8b/index.js%23L16; https://snyk.io/vuln/SNYK-JS-PICOTTS-1078539; https://github.com/luisivan/node-picotts/blob/8c6b183b884890c8e9422f93036b374942398c8b/index.js%23L16
CVE: CVE-2021-23379
Published: 2021-04-18
Description: This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/indatawetrust/portkiller/blob/f1f1c5076d9c5d60e8dd3930e98d665d8191aa7a/index.js%23L10; https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078537; https://github.com/indatawetrust/portkiller/blob/f1f1c5076d9c5d60e8dd3930e98d665d8191aa7a/index.js%23L10
CVE: CVE-2021-23380
Published: 2021-04-18
Description: This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-78
References: https://github.com/Svjard/pidusage/blob/772cd2bd675ff7b1244b6fe3d7541692b1b9e42c/lib/stats.js%23L103; https://snyk.io/vuln/SNYK-JS-ROARPIDUSAGE-1078528; https://github.com/Svjard/pidusage/blob/772cd2bd675ff7b1244b6fe3d7541692b1b9e42c/lib/stats.js%23L103