A command injection vulnerability affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28438
https://security.snyk.io/vuln/SNYK-JS-DEFERRE…
A command injection vulnerability affects all versions of the deprecated package google-cloudstorage-commands.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28436
https://github.com/samradical/google-cloudstorage-commands/blob/master/index.js%2…
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
Re…
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
Referenc…
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead.
References
https://nvd.nist.gov/vuln/detail/CVE-2…
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28455
https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067…
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-23451
https://github.com/M…
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
Refer…
A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath).
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28447
https://security.snyk.i…
A command injection vulnerability affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28443
https://security.snyk.io/vuln/SNYK-JS-SONARWRAPPER-105098…
