Snyk Security Database

systeminformation is a simple system and OS information library.

Affected versions of this package are vulnerable to Command Injection via the services() function on Windows, due to insufficient sanitization of shell strings in sanitizeShellString within lib/util.js. An attacker who controls the service name argument passed to services() can inject arbitrary PowerShell commands that are executed on the host system.

modoboa is a Mail hosting made simple

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via multiple API viewsets and serializers, where authorization checks are missing or insufficient. In the alarm bulk-delete endpoint, models.Alarm.objects.filter() is called directly instead of self.get_queryset(), allowing an authenticated user to delete alarms belonging to other users. In the autoreply serializer, the mbox field is not validated against the requesting user's mailbox, allowing a user to create or modify autoreply messages for mailboxes they do not own. In the calendars viewset, a user can access events from calendars that do not belong to them.

Affected versions of this package are vulnerable to Out-of-bounds Write (HTTP2Shell) via block-switch handling in the Brotli decoder, specifically DecodeBlockTypeAndLength in deps/brotli/c/dec/decode.c. An attacker can execute arbitrary code by supplying a crafted Brotli-compressed stream with an invalid block switch to the code that decodes it; the decoder fails to propagate the block-switch error during command processing, allowing the out-of-bounds write.