Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28210 State: PUBLISHED Published: 2020-11-19T21:01:31 Last Updated: 2024-08-04T16:33:58.334Z Vendors: n/a Products: EcoStruxure Building Operation WebStation V2.0 - V3.1 Problem Types: CWE-79 Description: A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-28211 State: PUBLISHED Published: 2020-11-19T21:03:37 Last Updated: 2024-08-04T16:33:58.139Z Vendors: n/a Products: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) Problem Types: CWE-863 Description: A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-07
CVE ID: CVE-2020-28212 State: PUBLISHED Published: 2020-11-19T21:03:43 Last Updated: 2024-08-04T16:33:58.114Z Vendors: n/a Products: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) Problem Types: CWE-307 Description: A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-07
CVE ID: CVE-2020-28213 State: PUBLISHED Published: 2020-11-19T21:03:54 Last Updated: 2024-08-04T16:33:58.563Z Vendors: n/a Products: PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) Problem Types: CWE-494 Description: A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-07
CVE ID: CVE-2020-28214 State: PUBLISHED Published: 2020-12-11T00:51:01 Last Updated: 2024-08-04T16:33:58.330Z Vendors: n/a Products: Modicon M221 (all references, all versions) Problem Types: CWE-760 Description: A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisori
iner: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE ID: CVE-2020-28215 State: PUBLISHED Published: 2020-12-11T00:51:07 Last Updated: 2024-08-04T16:33:58.156Z Vendors: n/a Products: Easergy T300 (firmware 2.7 and older) Problem Types: CWE-862 Description: A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03
CVE ID: CVE-2020-28216 State: PUBLISHED Published: 2020-12-11T00:51:11 Last Updated: 2024-08-04T16:33:59.042Z Vendors: n/a Products: Easergy T300 (firmware 2.7 and older) Problem Types: CWE-311 Description: A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03
CVE ID: CVE-2020-28217 State: PUBLISHED Published: 2020-12-11T00:51:15 Last Updated: 2024-08-04T16:33:58.410Z Vendors: n/a Products: Easergy T300 (firmware 2.7 and older) Problem Types: CWE-311 Description: A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03
CVE ID: CVE-2020-28218 State: PUBLISHED Published: 2020-12-11T00:51:19 Last Updated: 2024-08-04T16:33:58.099Z Vendors: n/a Products: Easergy T300 (firmware 2.7 and older) Problem Types: CWE-1021 Description: A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to trick a user into initiating an unintended action. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03
CVE ID: CVE-2020-28219 State: PUBLISHED Published: 2020-12-11T00:51:24 Last Updated: 2024-08-04T16:33:58.549Z Vendors: n/a Products: EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1) Problem Types: CWE-522 Description: A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020,
81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-343-02/
CVE ID: CVE-2020-28220 State: PUBLISHED Published: 2020-12-11T00:51:29 Last Updated: 2024-08-04T16:33:58.490Z Vendors: n/a Products: Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions) Problem Types: CWE-119 Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a buffer overflow when the length of a file transferred to the webserver is not verified. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/down
ebserver is not verified. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-343-09/
CVE ID: CVE-2020-28221 State: PUBLISHED Published: 2021-01-25T17:08:37 Last Updated: 2024-08-04T16:33:58.933Z Vendors: n/a Products: EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series Problem Types: CWE-20 Description: A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. Addi
he notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2021-012-01/
CVE ID: CVE-2020-28241 State: PUBLISHED Published: 2020-11-06T04:43:12 Last Updated: 2024-08-04T16:33:58.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maxmind/libmaxminddb/issues/236 - https://github.com/maxmind/libmaxminddb/pull/237 - https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3 - https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html - https://security.gentoo.org/glsa/202011-15 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
ecurity.gentoo.org/glsa/202011-15 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/
CVE ID: CVE-2020-28242 State: PUBLISHED Published: 2020-11-06T05:02:58 Last Updated: 2024-08-04T16:33:58.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be
(even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur. Additional Analyst Notes: - CVE Program Container: References: - http://downloads.asterisk.org/pub/security/AST-2020-002.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUS54QTQCYKR36EIULYD544GXDA644HB/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
CVE ID: CVE-2020-28243 State: PUBLISHED Published: 2021-02-27T00:00:00 Last Updated: 2024-08-04T16:33:58.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. Additional Analyst Notes: - CVE Program Container: References: - https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/ - https://github.com/stealthcopter/CVE-2020-28243 - https://sec.stealthcopter.com/cve-2020-28243/ - https:
-2021-feb-25/ - https://github.com/stealthcopter/CVE-2020-28243 - https://sec.stealthcopter.com/cve-2020-28243/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/ - https://security.gentoo.org/glsa/202103-01 - https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://lists.debian.org/
rg/debian-lts-announce/2021/11/msg00009.html - https://www.debian.org/security/2021/dsa-5011 - https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2020-28246 State: PUBLISHED Published: 2022-05-31T00:00:00 Last Updated: 2024-08-04T16:33:58.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE: the email templating service was removed after 2020. Additionally, the vendor disputes this issue indicating this is sandboxed and only executable by admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/formio/formio - https://github.com/formio/enterprise-release/blob/master/API-Server-Change-Log.md
CVE ID: CVE-2020-28247 State: PUBLISHED Published: 2020-11-12T18:03:45 Last Updated: 2024-08-04T16:33:58.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lettre/lettre - https://github.com/RustSec/advisory-db/pull/478/files - https://rustsec.org/advisories/RUSTSEC-2020-0069.html
CVE ID: CVE-2020-28248 State: PUBLISHED Published: 2021-02-19T23:05:09 Last Updated: 2024-08-04T16:33:58.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gemini-testing/png-img - https://github.com/gemini-testing/png-img/commit/14ac462a32ca4b3b78f56502ac976d5b0222ce3d - https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0 - https://securitylab.github.com/advisories/G
22ce3d - https://github.com/gemini-testing/png-img/compare/v3.0.0...v3.1.0 - https://securitylab.github.com/advisories/GHSL-2020-142-gemini-png-img
CVE ID: CVE-2020-28249 State: PUBLISHED Published: 2020-11-06T06:05:55 Last Updated: 2024-08-04T16:33:58.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laurent22/joplin/releases - https://github.com/fhlip0/JopinXSS
CVE ID: CVE-2020-28250 State: PUBLISHED Published: 2020-11-06T06:15:04 Last Updated: 2024-08-04T16:33:58.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/summtime/CVE/tree/master/CVE-2020-28250
CVE ID: CVE-2020-28251 State: PUBLISHED Published: 2020-12-03T16:47:09 Last Updated: 2024-08-04T16:33:58.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provide someone with administrative access to a sensor, with credentials to invoke a command to provide root access to the operating system. The attacker must complete a straightforward password-cracking exercise. Additional Analyst Notes: - CVE Program Container: References: - https://www.netscout.com/products - https://www.netscout.com/securityadvisories
CVE ID: CVE-2020-28267 State: PUBLISHED Published: 2020-11-10T15:58:51 Last Updated: 2024-08-04T16:33:58.817Z Vendors: n/a Products: @strikeentco/set Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strikeentco/set/commit/102cc6b2e1d1e0c928ced87e75df759d5541ff60 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28267
CVE ID: CVE-2020-28268 State: PUBLISHED Published: 2020-11-15T22:45:03 Last Updated: 2024-08-04T16:33:58.133Z Vendors: n/a Products: controlled-merge Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hlfshell/controlled-merge/commit/5a4b2e9ffe5a0be7f8843d4ab038599d3ae5f9d4 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28268
CVE ID: CVE-2020-28269 State: PUBLISHED Published: 2020-11-12T17:16:17 Last Updated: 2024-08-04T16:33:58.614Z Vendors: n/a Products: field Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28269 - https://github.com/jprichardson/field/blob/2a3811dfc4cdd13833977477d2533534fc61ce06/lib/field.js#L39
CVE ID: CVE-2020-28270 State: PUBLISHED Published: 2020-11-12T17:16:50 Last Updated: 2024-08-04T16:33:58.388Z Vendors: n/a Products: object-hierarchy-access Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mjpclab/object-hierarchy-access/commit/7b1aa134a8bc4a376296bcfac5c3463aef2b7572 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28270
CVE ID: CVE-2020-28271 State: PUBLISHED Published: 2020-11-12T17:17:20 Last Updated: 2024-08-04T16:33:58.397Z Vendors: n/a Products: deephas Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28271 - https://github.com/sharpred/deepHas/commit/2fe011713a6178c50f7deb6f039a8e5435981e20
CVE ID: CVE-2020-28272 State: PUBLISHED Published: 2020-12-02T14:32:00 Last Updated: 2024-08-04T16:33:58.666Z Vendors: n/a Products: keyget Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28272 - https://github.com/rumkin/keyget/commit/17d15b6c75036eb429075a8cfeccfc18094dd2e2
CVE ID: CVE-2020-28273 State: PUBLISHED Published: 2020-12-02T14:34:07 Last Updated: 2024-08-04T16:33:58.176Z Vendors: n/a Products: set-in Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database - https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273
CVE ID: CVE-2020-28274 State: PUBLISHED Published: 2020-12-08T21:28:21 Last Updated: 2024-08-04T16:33:59.106Z Vendors: n/a Products: deepref Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28274%2Chttps://github.com/isaymatato/deepref/commit/24935e6a1060cb09c641d3075982f0b44cfca4c2
CVE ID: CVE-2020-28275 State: REJECTED Published: 2020-12-29T16:58:28 Last Updated: 2020-12-31T15:38:20 Description: No description available.
CVE ID: CVE-2020-28276 State: PUBLISHED Published: 2020-12-29T16:58:24 Last Updated: 2024-08-04T16:33:58.457Z Vendors: n/a Products: deep-set Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28276
CVE ID: CVE-2020-28277 State: PUBLISHED Published: 2020-12-29T16:58:21 Last Updated: 2024-08-04T16:33:59.022Z Vendors: n/a Products: dset Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lukeed/dset/blob/50a6ead172d1466a96035eff00f8eb465ccd050a/src/index.js#L6 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28277
CVE ID: CVE-2020-28278 State: PUBLISHED Published: 2020-12-29T17:10:45 Last Updated: 2024-08-04T16:33:59.068Z Vendors: n/a Products: shvl Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robinvdvleuten/shvl/blob/bef0a3ebade444cc6b297147ecf5242308f0892e/index.js#L10 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28278
CVE ID: CVE-2020-28279 State: PUBLISHED Published: 2020-12-29T17:10:47 Last Updated: 2024-08-04T16:33:58.917Z Vendors: n/a Products: flattenizer Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahellebusch/flattenizer/pull/13 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28279
CVE ID: CVE-2020-28280 State: PUBLISHED Published: 2020-12-29T17:10:49 Last Updated: 2024-08-04T16:33:58.421Z Vendors: n/a Products: predefine Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigpipe/predefine/blob/238137e3d1b8288ff5d7529c3cbcdd371888c26b/index.js#L284 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28280
CVE ID: CVE-2020-28281 State: PUBLISHED Published: 2020-12-29T17:05:02 Last Updated: 2024-08-04T16:33:58.134Z Vendors: n/a Products: set-object-value Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/react-atomic/react-atomic-organism/blob/e5645a2f9e632ffdebc83d720498831e09754c22/packages/lib/set-object-value/src/index.js#L16 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28281