Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10742 State: PUBLISHED Published: 2019-05-07T18:40:06 Last Updated: 2024-08-04T22:32:01.144Z Vendors: axios Products: axios Problem Types: n/a Description: Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded. Additional Analyst Notes: - CVE Program Container: References: - https://app.snyk.io/vuln/SNYK-JS-AXIOS-174505 - https://github.com/axios/axios/issues/1098 - https://github.com/axios/axios/pull/1485
CVE ID: CVE-2019-10743 State: PUBLISHED Published: 2019-10-28T22:09:22 Last Updated: 2024-08-04T22:32:01.212Z Vendors: n/a Products: archiver Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder.
et folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/research/zip-slip-vulnerability - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMHOLTARCHIVERCMDARC-174728%2C - https://github.com/mholt/archiver/pull/169
CVE ID: CVE-2019-10744 State: PUBLISHED Published: 2019-07-25T23:43:03 Last Updated: 2024-08-04T22:32:01.271Z Vendors: Snyk Products: lodash Problem Types: Prototype Pollution Description: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:3024 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://snyk.io/vuln/SNYK-JS-LODASH-450202 - https://security.netapp.com/advisory/ntap-20191004-0005/ - https://support.f5.com/csp/art
o/vuln/SNYK-JS-LODASH-450202 - https://security.netapp.com/advisory/ntap-20191004-0005/ - https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2019-10745 State: PUBLISHED Published: 2019-08-20T18:13:22 Last Updated: 2024-08-04T22:32:01.531Z Vendors: n/a Products: assign-deep Problem Types: Prototype Pollution Description: assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
CVE ID: CVE-2019-10746 State: PUBLISHED Published: 2019-08-23T16:43:49 Last Updated: 2024-08-04T22:32:01.518Z Vendors: n/a Products: mixin-deep Problem Types: Prototype Pollution Description: mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
ZCUNXMU3KDH5JN5BEPNIGUKC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
CVE ID: CVE-2019-10747 State: PUBLISHED Published: 2019-08-23T16:46:36 Last Updated: 2024-08-04T22:32:01.472Z Vendors: n/a Products: set-value Problem Types: Prototype Pollution Description: set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SETVALUE-450213 - https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292%40%3Cdev.drat.apache.org%3E - https://lists.fedoraproject.org/archi
35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292%40%3Cdev.drat.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/
CVE ID: CVE-2019-10748 State: PUBLISHED Published: 2019-10-28T21:42:45 Last Updated: 2024-08-04T22:32:01.529Z Vendors: n/a Products: Sequelize Problem Types: SQL Injection Description: Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450221 - https://github.com/sequelize/sequelize/commit/a72a3f5%2C - https://github.com/sequelize/sequelize/pull/11089%2C
CVE ID: CVE-2019-10749 State: PUBLISHED Published: 2019-10-29T16:06:05 Last Updated: 2024-08-04T22:32:01.594Z Vendors: n/a Products: sequelize Problem Types: SQL Injection Description: sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222 - https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68
CVE ID: CVE-2019-10750 State: PUBLISHED Published: 2019-08-23T16:50:36 Last Updated: 2024-08-04T22:32:01.588Z Vendors: n/a Products: deeply Problem Types: Prototype Pollution Description: deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
CVE ID: CVE-2019-10751 State: PUBLISHED Published: 2019-08-23T16:38:35 Last Updated: 2024-08-04T22:32:01.703Z Vendors: n/a Products: HTTPIE Problem Types: Open Redirect Description: All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-HTTPIE-460107 - https://github.com/jakubroztocil/httpie/releases/tag/1.0.3 - http://lists.opensuse.org/opensuse-security-
TTPIE-460107 - https://github.com/jakubroztocil/httpie/releases/tag/1.0.3 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00031.html
CVE ID: CVE-2019-10752 State: PUBLISHED Published: 2019-10-17T18:12:43 Last Updated: 2024-08-04T22:32:01.546Z Vendors: n/a Products: sequelize Problem Types: SQL Injection Description: Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sequelize/sequelize/commit/9bd0bc1%2C - https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e - https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C
CVE ID: CVE-2019-10753 State: PUBLISHED Published: 2019-09-05T19:45:24 Last Updated: 2024-08-04T22:32:01.979Z Vendors: n/a Products: Spotless Problem Types: Unsafe Dependancy Resolution Description: In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these c
e build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377
CVE ID: CVE-2019-10754 State: PUBLISHED Published: 2019-09-23T22:09:32 Last Updated: 2024-08-04T22:32:01.987Z Vendors: n/a Products: Apereo CAS Problem Types: Insecure Randomness Description: Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406 - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402 - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404 - https://snyk.io/vuln/SNYK-JAVA-O
ln/SNYK-JAVA-ORGAPEREOCAS-467402 - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404 - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869 - https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868
CVE ID: CVE-2019-10755 State: PUBLISHED Published: 2019-09-23T22:13:04 Last Updated: 2024-08-04T22:32:01.535Z Vendors: n/a Products: PAC4J For SAML Protocol Problem Types: Insecure Randomness Description: The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
CVE ID: CVE-2019-10756 State: PUBLISHED Published: 2019-10-08T18:58:18 Last Updated: 2024-08-04T22:32:01.593Z Vendors: n/a Products: node-red-dashboard Problem Types: Cross-site Scripting (XSS) Description: It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEREDDASHBOARD-471939
CVE ID: CVE-2019-10757 State: PUBLISHED Published: 2019-10-08T19:04:11 Last Updated: 2024-08-04T22:32:01.495Z Vendors: n/a Products: knex.js Problem Types: SQL Injection Description: knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KNEX-471962
CVE ID: CVE-2019-10758 State: PUBLISHED Published: 2019-12-24T21:08:36.000Z Last Updated: 2025-10-21T23:35:54.793Z Vendors: n/a Products: mongo-express Problem Types: Remote Code Execution Description: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
CVE ID: CVE-2019-10759 State: PUBLISHED Published: 2019-10-15T14:47:19 Last Updated: 2024-08-04T22:32:01.921Z Vendors: Snyk Products: safer-eval Problem Types: Arbitrary Code Execution Description: safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SAFEREVAL-173772
CVE ID: CVE-2019-10760 State: PUBLISHED Published: 2019-10-15T14:53:11 Last Updated: 2024-08-04T22:32:01.515Z Vendors: Snyk Products: safer-eval Problem Types: Arbitrary Code Execution Description: safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SAFEREVAL-473029
CVE ID: CVE-2019-10761 State: PUBLISHED Published: 2022-07-13T08:20:14.533113Z Last Updated: 2024-09-16T16:28:51.372Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: vm2 Problem Types: Sandbox Bypass Description: This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: R
pt allowing it to spawn a child_process and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-VM2-473188 - https://github.com/patriksimek/vm2/issues/197 - https://github.com/patriksimek/vm2/commit/4b22d704e4794af63a5a2d633385fd20948f6f90
CVE ID: CVE-2019-10762 State: PUBLISHED Published: 2019-10-30T21:14:05 Last Updated: 2024-08-04T22:32:01.545Z Vendors: n/a Products: medoo Problem Types: SQL Injection Description: columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-CATFANMEDOO-474562 - https://github.com/catfan/Medoo/commit/659864b393961bf224bba1efc03b7dcbed7de533
CVE ID: CVE-2019-10763 State: PUBLISHED Published: 2019-11-18T19:55:07 Last Updated: 2024-08-04T22:32:01.595Z Vendors: n/a Products: pimcore/pimcore Problem Types: SQL Injection Description: pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-480391 - https://blog.certimetergroup.com/it/articolo/secur
: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-480391 - https://blog.certimetergroup.com/it/articolo/security/sql_injection_in_pimcore_6.2.3
CVE ID: CVE-2019-10764 State: PUBLISHED Published: 2019-11-18T21:55:34 Last Updated: 2024-08-04T22:32:01.903Z Vendors: n/a Products: simplito/elliptic-php Problem Types: Timing Attack Description: In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key. Additional Analyst Notes: - CVE Program Container: References: - https://minerva.crocs.fi.muni.cz/ - https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLI
s: - CVE Program Container: References: - https://minerva.crocs.fi.muni.cz/ - https://snyk.io/vuln/SNYK-PHP-SIMPLITOELLIPTICPHP-534576
CVE ID: CVE-2019-10765 State: PUBLISHED Published: 2019-11-20T15:38:43 Last Updated: 2024-08-04T22:32:02.018Z Vendors: n/a Products: iobroker.admin Problem Types: Directory Traversal Description: iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634 - https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd
CVE ID: CVE-2019-10766 State: PUBLISHED Published: 2019-11-19T19:17:41 Last Updated: 2024-08-04T22:32:01.902Z Vendors: n/a Products: Pixie Query Builder Problem Types: SQL Injection Description: Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-USMANHALALITPIXIE-534879
CVE ID: CVE-2019-10767 State: PUBLISHED Published: 2019-11-21T16:09:40 Last Updated: 2024-08-04T22:32:01.573Z Vendors: n/a Products: iobroker.js-controller Problem Types: Directory Traversal Description: An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fd
ntainer: References: - https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda - https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881
CVE ID: CVE-2019-10768 State: PUBLISHED Published: 2019-11-19T20:07:49 Last Updated: 2024-08-04T22:32:01.679Z Vendors: n/a Products: AngularJS Problem Types: Prototype Pollution Description: In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ANGULAR-534884 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
CVE ID: CVE-2019-10769 State: PUBLISHED Published: 2019-12-06T22:49:56 Last Updated: 2024-08-04T22:32:02.024Z Vendors: n/a Products: safer-eval Problem Types: Arbitrary Code Execution Description: safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/commenthol/safer-eval/security/advisories/GHSA-v63x-xc9j-hhvq - https://snyk.io/vuln/SNYK-JS-SAFEREVAL-534901
CVE ID: CVE-2019-10770 State: PUBLISHED Published: 2020-01-28T00:21:46 Last Updated: 2024-08-04T22:32:01.587Z Vendors: n/a Products: io.ratpack:ratpack-core Problem Types: Cross-site Scripting (XSS) Description: All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-IORATPACK-53
pment mode. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-IORATPACK-534882
CVE ID: CVE-2019-10771 State: PUBLISHED Published: 2019-11-25T22:39:39 Last Updated: 2024-08-04T22:32:01.665Z Vendors: n/a Products: iobroker.web Problem Types: Cross-site Scripting (XSS) Description: Characters in the GET url path are not properly escaped and can be reflected in the server response. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971
CVE ID: CVE-2019-10772 State: PUBLISHED Published: 2019-12-11T15:23:04 Last Updated: 2024-08-04T22:32:02.031Z Vendors: n/a Products: enshrined/svg-sanitize Problem Types: Cross-site Scripting (XSS) via Sanitizer Bypass Description: It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-ENSHRINEDSVGSANITIZE-536969
CVE ID: CVE-2019-10773 State: PUBLISHED Published: 2019-12-16T19:31:34 Last Updated: 2024-08-04T22:32:01.551Z Vendors: n/a Products: Yarn Problem Types: Arbitrary File Write Description: In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-YARN-537806%2C - https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7 - https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023 - https
it/039bafd74b7b1a88a53a54f8fa6fa872615e90e7 - https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023 - https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/ - https://access.redhat.com/errata/RHSA-2020:0475
CVE ID: CVE-2019-10774 State: PUBLISHED Published: 2019-12-30T16:26:45 Last Updated: 2024-08-04T22:32:02.079Z Vendors: n/a Products: php-shellcommand Problem Types: Command Injection Description: php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-MIKEHAERTLPHPSHELLCOMMAND-538426
CVE ID: CVE-2019-10775 State: PUBLISHED Published: 2020-01-02T14:51:29 Last Updated: 2024-08-04T22:32:01.651Z Vendors: n/a Products: ecstatic Problem Types: Denial of Service Description: ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ECSTATIC-540354
CVE ID: CVE-2019-10776 State: PUBLISHED Published: 2020-01-07T18:27:13 Last Updated: 2024-08-04T22:32:01.701Z Vendors: n/a Products: git-diff-apply Problem Types: Command Injection Description: In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kellyselden/git-diff-apply/commit/106d61d3ae723b4257c2a13e67b95eb40a27e0b5 - https://snyk.io/vuln/SNYK-JS-GITDIFFAPPLY-540774%2C