Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23381PUBLISHED: 2021-04-18This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374PUBLISHED: 2021-04-18This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375PUBLISHED: 2021-04-18This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23376PUBLISHED: 2021-04-18This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23377PUBLISHED: 2021-04-18This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
0 Comments
Tweet This
User Rank: Apprentice
11/18/2014 | 7:21:11 AM
Per your comment -
""line-of-business leaders know they need to evaluate vendors based on security but also realize that they don't have the knowledge to ask the depth of questions necessary to truly look out for pitfalls"
What happens when the IT department does not have the knowledge to ask the right questions either? This could lead to a disjointed cloud service being purchased that cannot be supported by the either the LOB or IT organization. When this happens, then the LOB would be forced to find alternatives to help support their cloud services which were purchased outside of the IT department.
I realize that many LOB's utilize cloud services outside of IT organizations line of sight. I for one am not a advocate of this type of IT strategy, as it tends to create more problems in the long term than it solves.