All CVEs — page 245 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This vulnerability allows attackers to execute shell commands by injecting OS metacharacters into the filepath and convertTo arguments, leading to remote code execution with Node.js process privileges.
The vulnerability allows attackers to pollute JavaScript object prototypes through crafted dotted paths, enabling them to inject properties into all objects and potentially alter authorization behavior or crash processes. This affects applications using the dot-access library version 1.0.0.
This vulnerability allows remote attackers to execute arbitrary JavaScript code by supplying crafted paths, leading to potential remote code execution in Node.js applications using dot-access.
The vulnerability in ppt2png through 0.0.6 allows attackers to execute arbitrary OS commands via unsanitized input, posing a critical risk.
A SQL injection vulnerability exists in MariaDB Connector/Node.js where attacker-controlled object keys can be improperly processed into SQL SET clauses, allowing unauthorized column updates and arbitrary SQL execution with database user privileges. This affects versions 3.2.0 through 3.2.5, 3.3.4, 3.4.7, and 3.5.4 when the permitSetMultiParamEntries option is enabled.
MariaDB Connector/Node.js has a buffer overflow vulnerability where uninitialized heap data gets leaked into database values when processing GeoJSON polygon and multipolygon data. This occurs because the code allocates memory based on array length before validating that the data is actually an array, potentially exposing sensitive information like session tokens, credentials, or TLS keys.
A vulnerability in Amazon Agent Plugins for AWS databases-on-aws plugin allows remote attackers to execute arbitrary OS commands on the host system by crafting malicious database command values. This represents a high-severity security flaw that could lead to full system compromise.
The flaw involves improper state management in MongoDB's libmongocrypt, allowing an authenticated actor to cause memory corruption and application termination. This matters because it can lead to service disruption and potential data corruption.