Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/systeminformation@4.14.8 |
| Type | npm |
| Namespace | |
| Name | systeminformation |
| Version | 4.14.8 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 5.6.4 |
| Latest_non_vulnerable_version | 5.31.6 |
| Affected_by_vulnerabilities |
| 0 |
|
| 1 |
| url |
VCID-6t9m-cpgx-z3hb |
| vulnerability_id |
VCID-6t9m-cpgx-z3hb |
| summary |
OS Command Injection
npm package systeminformation is vulnerable to Prototype Pollution leading to Command Injection.If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `si.inetChecksite().` |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-26245, GHSA-4v2w-h9jm-mqjg
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6t9m-cpgx-z3hb |
|
| 2 |
| url |
VCID-axru-z7ku-nyh8 |
| vulnerability_id |
VCID-axru-z7ku-nyh8 |
| summary |
OS Command Injection
This affects the package systeminformation The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-7778, GHSA-8j36-q8x7-pm6q
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-axru-z7ku-nyh8 |
|
| 3 |
| url |
VCID-c47r-q1dv-8qg7 |
| vulnerability_id |
VCID-c47r-q1dv-8qg7 |
| summary |
The systeminformation package is vulnerable to Command Injection. An attacker can concatenate the curl command's parameters to overwrite Javascript files and then execute any OS commands. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-7752, GHSA-94xh-2fmc-xf5j
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-c47r-q1dv-8qg7 |
|
| 4 |
| url |
VCID-fen5-17u8-efbs |
| vulnerability_id |
VCID-fen5-17u8-efbs |
| summary |
OS Command Injection
systeminformation is an open source system and OS information library for node.Please upgrade to If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-21388, GHSA-jff2-qjw8-5476
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fen5-17u8-efbs |
|
| 5 |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | null |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/systeminformation@4.14.8 |