Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28464 State: PUBLISHED Published: 2021-01-04T11:50:18.411558Z Last Updated: 2024-09-17T02:27:33.400Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: djv Problem Types: Remote Code Execution (RCE) Description: This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DJV-1014545 - https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55 - https://github.com/korzio/djv/pull/98/files
CVE ID: CVE-2020-28466 State: PUBLISHED Published: 2021-03-07T09:55:16.528274Z Last Updated: 2024-09-16T18:34:41.668Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: github.com/nats-io/nats-server/server Problem Types: Denial of Service (DoS) Description: This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated
resents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967 - https://github.com/nats-io/nats-server/pull/1731 - http://www.openwall.com/lists/oss-security/2021/03/16/
RVER-1042967 - https://github.com/nats-io/nats-server/pull/1731 - http://www.openwall.com/lists/oss-security/2021/03/16/1 - http://www.openwall.com/lists/oss-security/2021/03/16/2
CVE ID: CVE-2020-28468 State: PUBLISHED Published: 2021-01-08T11:20:13.794321Z Last Updated: 2024-09-16T23:22:02.072Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: pwntools Problem Types: Improper Control of Generation of Code ('Code Injection') Description: This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345 - https://github.com/Gallopsled/pwntools/issues/1427 - https://git
: - https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345 - https://github.com/Gallopsled/pwntools/issues/1427 - https://github.com/Gallopsled/pwntools/pull/1732
CVE ID: CVE-2020-28469 State: PUBLISHED Published: 2021-06-03T15:15:13.479278Z Last Updated: 2024-09-16T18:43:30.050Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: glob-parent Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059092 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093 - https://github.com/
NYK-JAVA-ORGWEBJARSNPM-1059092 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBES128-1059093 - https://github.com/gulpjs/glob-parent/blob/6ce8d11f2f1ed8e80a9526b1dc8cf3aa71f43474/index.js%23L9 - https://github.com/gulpjs/glob-parent/pull/36 - https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2020-28470 State: PUBLISHED Published: 2021-01-14T09:35:14.221208Z Last Updated: 2024-09-16T23:21:29.015Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: @scullyio/scully Problem Types: Cross-site Scripting (XSS) Description: This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SCULLYIOSCULLY-1055829 - https://github.com/scullyio/scully/pull/1182
CVE ID: CVE-2020-28471 State: PUBLISHED Published: 2022-07-25T14:08:45.203897Z Last Updated: 2024-09-16T23:21:59.677Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: properties-reader Problem Types: Prototype Pollution Description: This affects the package properties-reader before 2.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-PROPERTIESREADER-1048968 - https://github.com/steveukx/properties/commit/0877cc871db9865f58dd9389ce99e61be05380a5 - https://github.com/steveukx/properties/issues/40
CVE ID: CVE-2020-28472 State: PUBLISHED Published: 2021-01-19T10:25:15.313657Z Last Updated: 2024-09-16T23:06:31.989Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: @aws-sdk/shared-ini-file-loader, aws-sdk Problem Types: Prototype Pollution Description: This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - http
can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304 - https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426 - https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9 - https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611
CVE ID: CVE-2020-28473 State: PUBLISHED Published: 2021-01-18T11:15:14.918598Z Last Updated: 2024-09-16T20:41:35.337Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: bottle Problem Types: Web Cache Poisoning Description: The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the
efault configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108 - https://github.com/bottlepy/bottle - https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html
CVE ID: CVE-2020-28476 State: REJECTED Published: 2021-01-18T11:15:20 Last Updated: 2021-02-15T16:01:12 Description: No description available.
CVE ID: CVE-2020-28477 State: PUBLISHED Published: 2021-01-19T10:20:13.022549Z Last Updated: 2024-09-17T04:25:21.993Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: immer Problem Types: Prototype Pollution Description: This affects all versions of package immer. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-IMMER-1019369 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986 - https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213
CVE ID: CVE-2020-28478 State: PUBLISHED Published: 2021-01-19T10:20:17.531386Z Last Updated: 2024-09-16T20:33:01.205Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: gsap Problem Types: Prototype Pollution Description: This affects the package gsap before 3.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GSAP-1054614 - https://github.com/greensock/GSAP/blob/master/src/gsap-core.js%23L147
CVE ID: CVE-2020-28479 State: PUBLISHED Published: 2021-01-19T14:45:28.808781Z Last Updated: 2024-09-17T01:40:37.485Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: jointjs Problem Types: Denial of Service (DoS) Description: The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JOINTJS-1062038 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1062039 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062040 - https://github.com/clientIO/joint/releases/tag/v3.3.0
CVE ID: CVE-2020-28480 State: PUBLISHED Published: 2021-01-19T14:45:22.933123Z Last Updated: 2024-09-16T17:07:41.852Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: jointjs Problem Types: Prototype Pollution Description: The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JOINTJS-1024444 - https://snyk.io/vuln/SNYK-JAV
tes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JOINTJS-1024444 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1062036 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062037 - https://github.com/clientIO/joint/blob/master/src/util/util.mjs%23L150 - https://github.com/clientIO/joint/pull/1406
CVE ID: CVE-2020-28481 State: PUBLISHED Published: 2021-01-19T14:45:17.064568Z Last Updated: 2024-09-16T20:11:33.987Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: socket.io Problem Types: Insecure Defaults Description: The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358 - https://github.com/socketio/socket.io/issues/3671
CVE ID: CVE-2020-28482 State: PUBLISHED Published: 2021-01-19T14:50:18.191366Z Last Updated: 2024-09-16T19:05:34.497Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: n/a Products: fastify-csrf Problem Types: Cross-site Request Forgery (CSRF) Description: This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FASTIFYCSRF-1062044 - https://github.com/fastify/fastify-csrf/pull/26
CVE ID: CVE-2020-28483 State: PUBLISHED Published: 2021-01-20T17:46:29.476098Z Last Updated: 2024-09-16T17:28:31.192Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: n/a Products: github.com/gin-gonic/gin Problem Types: HTTP Response Splitting Description: This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 - https://github.com/gin-gonic/gin/pull/2474%23issuecomment-729696437
CVE ID: CVE-2020-28487 State: PUBLISHED Published: 2021-01-22T17:15:20.637280Z Last Updated: 2024-09-17T02:47:35.159Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: vis-timeline Problem Types: Cross-site Scripting (XSS) Description: This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBO
VISTIMELINE-1063500 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502 - https://github.com/visjs/vis-timeline/issues/838 - https://github.com/visjs/vis-timeline/pull/840
CVE ID: CVE-2020-28488 State: REJECTED Published: 2021-01-22T13:40:14 Last Updated: 2021-02-02T18:48:22 Description: No description available.
CVE ID: CVE-2020-28490 State: PUBLISHED Published: 2021-02-18T14:20:14.672136Z Last Updated: 2024-09-17T04:14:37.062Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: async-git Problem Types: Command Injection Description: The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb') Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ASYNCGIT-1064877 - https://github.com/omrilotan/async-git/pull/14 - https://github.com/omrilotan/async-git/commit/d1950a5021f4e19d92f347614be0d85ce991510d
CVE ID: CVE-2020-28491 State: PUBLISHED Published: 2021-02-18T15:50:15.260223Z Last Updated: 2024-09-16T20:16:27.638Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: com.fasterxml.jackson.dataformat:jackson-dataformat-cbor Problem Types: Denial of Service (DoS) Description: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329 - https://github
E Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329 - https://github.com/FasterXML/jackson-dataformats-binary/issues/186 - https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-28492 State: REJECTED Published: 2021-01-26T16:15:14 Last Updated: 2021-01-26T22:20:16 Description: No description available.
CVE ID: CVE-2020-28493 State: PUBLISHED Published: 2021-02-01T19:30:16.601731Z Last Updated: 2024-09-16T17:24:01.606Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: jinja2 Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting pr
ted by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994 - https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20 - https://github.com/pallets/jinja/pull/1343 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/ - https://security.gentoo.org/glsa/202107-19
CVE ID: CVE-2020-28494 State: PUBLISHED Published: 2021-02-02T10:25:22.372426Z Last Updated: 2024-09-16T16:33:03.828Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: total.js Problem Types: Command Injection Description: This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized. Additional Analyst Notes: - CVE Program Container: References: -
d because the type parameter is not properly sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672 - https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5
CVE ID: CVE-2020-28495 State: PUBLISHED Published: 2021-02-02T10:25:17.752905Z Last Updated: 2024-09-16T22:40:43.106Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: total.js Problem Types: Prototype Pollution Description: This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection. Additional Analyst Not
s it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671 - https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set - https://github.com/totaljs/framework/blob/master/utils.js%23L6606 - https://github.com/totaljs/framework/blob/master/utils.js%23L6617 - https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff
CVE ID: CVE-2020-28496 State: PUBLISHED Published: 2021-02-18T14:20:22.065286Z Last Updated: 2024-09-17T01:01:31.663Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: three Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms") Additional Analyst Notes: - CVE
lor(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms") Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-THREE-1064931 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972 - https://github.com/mrdoob/three.js/issues/21132 - https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e
CVE ID: CVE-2020-28498 State: PUBLISHED Published: 2021-02-02T18:50:18.725744Z Last Updated: 2024-09-17T02:00:51.979Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: elliptic Problem Types: Cryptographic Issues Description: The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed. Additional Analyst Notes: - CV
ed in this implementation to be revealed after a number of ECDH operations are performed. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1069836 - https://github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md - https://github.com/indutny/elliptic/commit/441b7428b0e8f6636c42118ad2aaa186d3c34c3f
CVE ID: CVE-2020-28499 State: PUBLISHED Published: 2021-02-18T16:05:19.639975Z Last Updated: 2024-09-16T22:08:33.285Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: merge Problem Types: Prototype Pollution Description: All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge . Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MERGE-1042987 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049 - https://github.com/yeikos/js.merge/blob/master/src/index.ts%23L64
CVE ID: CVE-2020-28500 State: PUBLISHED Published: 2021-02-15T11:10:16.225227Z Last Updated: 2024-09-16T22:15:52.206Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: Lodash Problem Types: Regular Expression Denial of Service (ReDoS) Description: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LODASH-1018905 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893 - https://snyk.io/vuln/SNYK-JAVA-ORGWEB
A-ORGWEBJARSBOWER-1074892 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895 - https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896 - https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8 - https://github.com/lodash/lodash/pull/5065 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210312-0006/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://cert-portal.siemens.com/productcert/p
cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE ID: CVE-2020-28501 State: PUBLISHED Published: 2021-03-22T12:10:13.637177Z Last Updated: 2024-09-16T22:40:25.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: es6-crawler-detect Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ES6CRAWLERDETECT-1051529 - https://github.com/JefferyHus/es6-crawler-detect/pull/27