Xiaofen9

The issue is related to insufficient argument checking in the npm-dependency-versions package, which can lead to command injection. An attacker can exploit this by calling dependencyVersions with a JSON object containing a `pkgs` key and shell metacharacters in a value, potentially allowing remote execution of arbitrary commands.

The issue allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable `ipcRenderer` IPC interface, which invokes the `openExternal` Electron API.

Name of the Vulnerable Software and Affected Versions: Camunda Modeler versions through 4.6.0 Description: The issue allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which manipulates the `readFile` and `writeFile` APIs. The vendor states that the app is secured in a way that it does not allow any remote scripts to be opened, no unsafe scripts to be evaluated, and no remote sites to be browsed. Recommendations: For Camunda Modeler versions through 4.6.0, consider disabling the `ipcRenderer` IPC interface as a temporary workaround until a patch is available. Restrict access to the `readFile` and `writeFile` APIs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Clipper versions prior to 1.0.5 Description: The issue allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable `ipcRenderer` IPC interface, which invokes the `openExternal` API. Recommendations: For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ipcRenderer` IPC interface until a patch is available. Avoid using the `openExternal` API in the affected IPC interface until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Twinkle Tray (aka twinkle-tray) versions 1.13.3 and earlier Description: The issue allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable `ipcRenderer` IPC interface, which invokes the `openExternal` API. Recommendations: For versions 1.13.3 and earlier, as a temporary workaround, consider disabling the `ipcRenderer` IPC interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is caused by incorrect parsing of certain JSON input, which may result in js-bson not correctly serializing BSON. This can cause unexpected application behavior, including data disclosure.

The issue is related to the deserialization of untrusted data in the bson package. It occurs when the package ignores an unknown value for an object's ` bsotype` or ` bsontype`, leading to incorrect serialization of the object as a document instead of the intended BSON type. This can potentially allow a remote attacker to execute arbitrary code.

The issue allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.

The issue allows attackers to forge adding additional properties into user-input processed by taffy, which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If an index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format, such as `T000002R000001`. As such, attackers can use this vulnerability to access any data items in the DB.

A maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` functions used within schema-inspector.

The issue is related to insufficient input validation in the kind-of library, which can be exploited by a remote attacker to cause a denial of service. Specifically, the `ctorName` in `index.js` of kind-of version 6.0.2 allows external user input to overwrite internal attributes via a conflicting name. A crafted payload can manipulate the type detection result by overwriting a built-in attribute. This can enable attackers to bypass type checking validation.

The issue allows certain internal attributes to be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects the validate() function, enabling a crafted payload to manipulate the type detection result.

The issue allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in `template/game-server/app/servers/connector/handler/entryHandler.js` because certain internal attributes can be overwritten via a conflicting name. This enables a malicious attacker to manipulate internal attributes by adding additional attributes to user input.

The `validate()` input validation in class-validator can be bypassed because certain internal attributes can be overwritten via a conflicting name. Although there is an optional `forbidUnknownValues` parameter that can reduce the risk of this bypass, it is not documented, leading most developers to configure input validation in the vulnerable default manner. This allows attackers to launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The issue allows attackers to bypass access control in some applications because any query object with a ` bsontype` attribute is ignored. For example, adding ` bsontype`:"a" can sometimes interfere with a query filter. This is related to Mongoose's failure to work around the ` bsontype` special case that exists in older versions of the bson parser.

The issue allows path traversal in certain scenarios, potentially enabling attackers to overwrite arbitrary files. This can be achieved by using an archive with an executable file that has an initial ../ in its filename. In some cases, this could lead to arbitrary code execution if critical modules, such as the decompile module, are overwritten.