Поиск уязвимостей
Количество 27
Количество 27
CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary ...
GHSA-x8qc-rrcw-4r46
npm symlink reference outside of node_modules
GHSA-4328-8hgf-7wjr
npm Vulnerable to Global node_modules Binary Overwrite
BDU:2019-04690
Уязвимость набора инструментов командной строки пакетных менеджеров NPM и Yarn, позволяющая нарушителю записывать произвольные файлы
BDU:2019-04689
Уязвимость набора инструментов командной строки пакетных менеджеров NPM и Yarn, позволяющая нарушителю перезаписать произвольные файлы в контексте целевого каталога
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2019-16776 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. | CVSS3: 4.8 | 3% Низкий | почти 7 лет назад |
 | CVE-2019-16776 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. | CVSS3: 8.1 | 3% Низкий | почти 7 лет назад |
| CVE-2019-16776 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary ... | CVSS3: 8.1 | 3% Низкий | почти 7 лет назад |
| GHSA-x8qc-rrcw-4r46 npm symlink reference outside of node_modules | CVSS3: 7.7 | 3% Низкий | почти 7 лет назад |
| GHSA-4328-8hgf-7wjr npm Vulnerable to Global node_modules Binary Overwrite | CVSS3: 7.7 | 2% Низкий | почти 7 лет назад |
 | BDU:2019-04690 Уязвимость набора инструментов командной строки пакетных менеджеров NPM и Yarn, позволяющая нарушителю записывать произвольные файлы | CVSS3: 7.7 | 3% Низкий | почти 7 лет назад |
| BDU:2019-04689 Уязвимость набора инструментов командной строки пакетных менеджеров NPM и Yarn, позволяющая нарушителю перезаписать произвольные файлы в контексте целевого каталога | CVSS3: 7.7 | 2% Низкий | почти 7 лет назад |
Уязвимостей на страницу