Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23379 State: PUBLISHED Published: 2021-04-18T18:45:26.507362Z Last Updated: 2024-09-16T18:02:46.082Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: portkiller Problem Types: Arbitrary Command Injection Description: This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078537 - https://github.com/indatawetrust/portkiller/blob/f1f1c5076d9c5d
ces: - https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078537 - https://github.com/indatawetrust/portkiller/blob/f1f1c5076d9c5d60e8dd3930e98d665d8191aa7a/index.js%23L10
CVE ID: CVE-2021-23380 State: PUBLISHED Published: 2021-04-18T18:45:21.360448Z Last Updated: 2024-09-16T16:23:56.215Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: roar-pidusage Problem Types: Arbitrary Command Injection Description: This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ROARPIDUSAGE
sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ROARPIDUSAGE-1078528 - https://github.com/Svjard/pidusage/blob/772cd2bd675ff7b1244b6fe3d7541692b1b9e42c/lib/stats.js%23L103
CVE ID: CVE-2021-23381 State: PUBLISHED Published: 2021-04-18T18:45:16.404979Z Last Updated: 2024-09-17T03:39:05.669Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: killing Problem Types: Arbitrary Command Injection Description: This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLING-1078532 - https://github.com/xudafeng/killing/blob/672ed164ccdd10c0a8fb93c5c6d2456f1
ttps://snyk.io/vuln/SNYK-JS-KILLING-1078532 - https://github.com/xudafeng/killing/blob/672ed164ccdd10c0a8fb93c5c6d2456f1dfab781/lib/killing.js%23L62
CVE ID: CVE-2021-23382 State: PUBLISHED Published: 2021-04-26T15:30:26.301297Z Last Updated: 2024-09-16T23:26:53.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: postcss Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640 - https://snyk.io/vuln/SNYK-JAVA-ORGWEB
VE Program Container: References: - https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641 - https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956
CVE ID: CVE-2021-23383 State: PUBLISHED Published: 2021-05-04T08:35:21.209216Z Last Updated: 2024-09-16T19:15:14.519Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: handlebars Problem Types: Prototype Pollution Description: The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 - https://snyk.io/vuln/SNYK-JAVA
89701698268578199be25285b2ebea1c1e427 - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 - https://security.netapp.com/advisory/ntap-20210618-0007/
CVE ID: CVE-2021-23384 State: PUBLISHED Published: 2021-05-17T17:45:12.371989Z Last Updated: 2024-09-16T20:36:40.039Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: koa-remove-trailing-slashes Problem Types: Open Redirect Description: The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::removeTrailingSlashes(), as the web server uses relative URLs instead of absolute URLs. Additional Analyst Notes: - CVE Program Container: Ref
), as the web server uses relative URLs instead of absolute URLs. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KOAREMOVETRAILINGSLASHES-1085708 - https://github.com/vgno/koa-remove-trailing-slashes/blame/6a01ba8fd019bd3ece44879c553037ad96ba7d47/index.js%23L31
CVE ID: CVE-2021-23385 State: PUBLISHED Published: 2022-08-02T13:25:14.717803Z Last Updated: 2024-09-16T22:08:36.808Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: Flask-Security Problem Types: Open Redirect Description: This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modi
only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234 - https://github.com/mattupstate/flask-security - https://snyk.io/blog/url-confusion-vulnerabilities/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html
CVE ID: CVE-2021-23386 State: PUBLISHED Published: 2021-05-20T16:15:18.500581Z Last Updated: 2024-09-16T20:52:54.669Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: n/a Products: dns-packet Problem Types: Remote Memory Exposure Description: This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-129571
iner: References: - https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719 - https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858 - https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
CVE ID: CVE-2021-23387 State: PUBLISHED Published: 2021-05-24T18:16:34.116418Z Last Updated: 2024-09-17T02:31:13.513Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: trailing-slash Problem Types: Open Redirect Description: The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/S
e URLs instead of absolute URLs. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707 - https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95e35670/index.js%23L36 - https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077d8f05048
CVE ID: CVE-2021-23388 State: PUBLISHED Published: 2021-05-31T13:50:11.522707Z Last Updated: 2024-09-17T03:47:34.020Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: forms Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FORMS-1296389 - https://github.com/caolan/forms/pull/214 - https://github.com/caolan/forms/pull/214/commits/d4bd5b5febfe49c1f585f162e04ec810f8dc47a0
CVE ID: CVE-2021-23389 State: PUBLISHED Published: 2021-07-12T15:15:18.459332Z Last Updated: 2024-09-16T18:33:56.688Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: total.js Problem Types: Arbitrary Code Execution Description: The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607 - https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631 - https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
CVE ID: CVE-2021-23390 State: PUBLISHED Published: 2021-07-12T15:15:12.069761Z Last Updated: 2024-09-17T04:15:03.053Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: total4 Problem Types: Arbitrary Code Execution Description: The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TOTAL4-1130527 - https://github.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455 - https://github.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821
CVE ID: CVE-2021-23391 State: PUBLISHED Published: 2021-06-07T20:40:11.448262Z Last Updated: 2024-09-16T22:24:49.196Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C) Vendors: n/a Products: calipso Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CALIPSO-1300555 - https://github.com/cliftonc/calipso
CVE ID: CVE-2021-23392 State: PUBLISHED Published: 2021-06-08T07:45:11.449561Z Last Updated: 2024-09-16T17:08:02.110Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: locutus Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LOCUTUS-1090597 - https://github.com/locutusjs/locutus/pull/446 - https://github.com/locutusjs/locutus/commit/eb863321990e7e5514aa14f68b8d9978ece9e65e
CVE ID: CVE-2021-23393 State: PUBLISHED Published: 2021-06-10T23:20:10.252434Z Last Updated: 2024-09-16T17:18:13.774Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: Flask-Unchained Problem Types: Open Redirect Description: This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_
lternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-FLASKUNCHAINED-1293189 - https://github.com/briancappello/flask-unchained/commit/71e36b28166f9ffbe0a991f51127f0984f7e6a40
CVE ID: CVE-2021-23394 State: PUBLISHED Published: 2021-06-13T11:05:11.816027Z Last Updated: 2024-09-16T22:30:47.517Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: studio-42/elfinder Problem Types: Remote Code Execution (RCE) Description: The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-STUDIO42ELFINDER-1290554 - https://github.com/Studio-42/elFinder - https://github.com/Studio-42/elFinder/issues/3295 -
-STUDIO42ELFINDER-1290554 - https://github.com/Studio-42/elFinder - https://github.com/Studio-42/elFinder/issues/3295 - https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1 - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
CVE ID: CVE-2021-23395 State: PUBLISHED Published: 2021-06-15T19:12:03.841662Z Last Updated: 2024-09-16T23:05:40.914Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: nedb Problem Types: Prototype Pollution Description: This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NEDB-1305279
CVE ID: CVE-2021-23396 State: PUBLISHED Published: 2021-06-17T16:15:10.405552Z Last Updated: 2024-09-16T18:59:42.541Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: lutils Problem Types: Prototype Pollution Description: All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LUTILS-1311023
CVE ID: CVE-2021-23397 State: PUBLISHED Published: 2022-07-25T14:07:41.094566Z Last Updated: 2024-09-16T19:10:52.652Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:C) Vendors: n/a Products: @ianwalter/merge Problem Types: Prototype Pollution Description: All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-IANWALTERMERGE-1311022
CVE ID: CVE-2021-23398 State: PUBLISHED Published: 2021-06-24T15:00:12.133838Z Last Updated: 2024-09-17T00:46:54.673Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: react-bootstrap-table Problem Types: Cross-site Scripting (XSS) Description: All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 - https://s
alyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286 - https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118 - https://github.com/AllenFang/react-bootstrap-table/issues/2071
CVE ID: CVE-2021-23399 State: PUBLISHED Published: 2021-06-28T07:30:13.604625Z Last Updated: 2024-09-17T03:02:52.915Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: wincred Problem Types: Arbitrary Command Injection Description: This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-WINCRED-1078538 - https://github.com/rolangom/wincred/blob/3fd
ram Container: References: - https://snyk.io/vuln/SNYK-JS-WINCRED-1078538 - https://github.com/rolangom/wincred/blob/3fd39186ee32add9c12046cdccf2765d19565335/index.ts%23L20
CVE ID: CVE-2021-23400 State: PUBLISHED Published: 2021-06-29T11:45:11.775773Z Last Updated: 2024-09-16T22:56:23.040Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: nodemailer Problem Types: HTTP Header Injection Description: The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737 - https://github.com/nodemailer/nodemailer/issues/1289 - https://githu
ps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737 - https://github.com/nodemailer/nodemailer/issues/1289 - https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
CVE ID: CVE-2021-23401 State: PUBLISHED Published: 2021-07-05T10:25:11.545785Z Last Updated: 2024-09-16T17:15:15.113Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: Flask-User Problem Types: Open Redirect Description: This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_lo
ernative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188 - https://github.com/lingthio/Flask-User - https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utils.py
CVE ID: CVE-2021-23402 State: PUBLISHED Published: 2021-07-02T16:10:10.867501Z Last Updated: 2024-09-16T16:59:12.075Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: record-like-deep-assign Problem Types: Prototype Pollution Description: All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-RECORDLIKEDEEPASSIGN-1311024 - https://github.com/kripod/record-like-deep-assign/blob/v1.0.1/src/mod.ts%23L17-L35
CVE ID: CVE-2021-23403 State: PUBLISHED Published: 2021-07-02T16:10:16.567604Z Last Updated: 2024-09-17T03:27:59.664Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: ts-nodash Problem Types: Prototype Pollution Description: All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TSNODASH-1311009 - https://github.com/BadOPCode/NoDash/blob/master/src/Merge.ts
CVE ID: CVE-2021-23404 State: PUBLISHED Published: 2021-09-08T10:50:10.067484Z Last Updated: 2024-09-16T18:29:23.999Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:R) Vendors: n/a Products: sqlite-web Problem Types: Cross-site Request Forgery (CSRF) Description: This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.i
ross Site Request Forgery (CSRF) attack. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-SQLITEWEB-1316324 - https://github.com/coleifer/sqlite-web/blob/2e7c85da3d37f80074ed3ae39b5851069b4f301c/sqlite_web/__main__.py%23L1
CVE ID: CVE-2021-23405 State: PUBLISHED Published: 2021-07-09T12:40:15.058789Z Last Updated: 2024-09-16T19:04:05.999Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C) Vendors: n/a Products: pimcore/pimcore Problem Types: SQL Injection Description: This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1316297 - https://github.com/pimcore/pimcore/pull/9572
CVE ID: CVE-2021-23406 State: PUBLISHED Published: 2021-08-24T07:45:13.637967Z Last Updated: 2024-09-17T02:26:53.603Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: pac-resolver Problem Types: Remote Code Execution (RCE) Description: This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857 - https://snyk.io/vuln/SNYK-JAVA-ORGWEB
rogram Container: References: - https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506 - https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5 - https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9e - https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0
CVE ID: CVE-2021-23407 State: PUBLISHED Published: 2021-07-14T16:40:11.659677Z Last Updated: 2024-09-16T23:16:02.633Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: elFinder.Net.Core Problem Types: Directory Traversal Description: This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1315152 - https://github.com/trannamtrung1st/elFinder.Net.Core/commit/5498c8a86b76ef089cfbd7ef8be014b61fa11c73 - https://g