Skip to content

Vendor

whereis project vulnerabilities

1 published CVE affecting whereis project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
1
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of whereis project alerts

Products

Latest whereis project CVEs

Newest publication first

  1. CVE-2018-3772 Command Injection in whereis

    Published
    CriticalCVSS 9.8 EPSS 2.8%

    Concatenating unsanitized user input in the whereis npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The whereis module is deprecated and it is recommended to use the which npm module instead.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.