Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7614 State: PUBLISHED Published: 2020-04-07T13:21:05 Last Updated: 2024-08-04T09:33:19.999Z Vendors: n/a Products: npm-programmatic Problem Types: Command Injection Description: npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NPMPROGRAMMATIC-564115 - https://github.com/Manak/npm-programmatic/blob/master/index.js#L18
CVE ID: CVE-2020-7615 State: PUBLISHED Published: 2020-04-07T13:14:04 Last Updated: 2024-08-04T09:33:19.996Z Vendors: n/a Products: fsa Problem Types: Command Injection Description: fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FSA-564118 - https://github.com/gregof/fsa/blob/master/lib/rep.js#L12
CVE ID: CVE-2020-7616 State: PUBLISHED Published: 2020-04-07T13:16:20 Last Updated: 2024-08-04T09:33:19.989Z Vendors: n/a Products: express-mock-middleware Problem Types: Prototype Pollution Description: express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EXP
ered to be a low risk. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120 - https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39
CVE ID: CVE-2020-7617 State: PUBLISHED Published: 2020-04-02T18:00:16 Last Updated: 2024-08-04T09:33:19.995Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: rawiroaisen Products: ini-parser Problem Types: Prototype Pollution Description: ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rawiroaisen/node-ini-parser/blob/master/index.js#L14 - https://snyk.io/vuln/SNYK-JS-INIPARSER-564122
CVE ID: CVE-2020-7618 State: PUBLISHED Published: 2020-04-07T13:22:49 Last Updated: 2024-08-04T09:33:19.976Z Vendors: n/a Products: sds Problem Types: Prototype Pollution Description: sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SDS-564123 - https://github.com/monsterkodi/sds/blob/master/js/set.js#L31
CVE ID: CVE-2020-7619 State: PUBLISHED Published: 2020-04-02T20:43:32 Last Updated: 2024-08-04T09:33:19.975Z Vendors: n/a Products: get-git-data Problem Types: Command Injection Description: get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chardos/get-git-data/blob/master/index.js#L7%2C - https://snyk.io/vuln/SNYK-JS-GETGITDATA-564222
CVE ID: CVE-2020-7620 State: PUBLISHED Published: 2020-04-02T20:38:52 Last Updated: 2024-08-04T09:33:19.930Z Vendors: n/a Products: pomelo-monitor Problem Types: Command Injection Description: pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js%2C - https://snyk.io/vuln/SNYK-JS-POMELOMONITOR-173695
CVE ID: CVE-2020-7621 State: PUBLISHED Published: 2020-04-02T20:49:06 Last Updated: 2024-08-04T09:33:19.954Z Vendors: n/a Products: strong-nginx-controller Problem Types: Command Injection Description: strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strongloop/strong-nginx-controller/blob/master/lib/server.js#L65%2C - https://snyk.io/vuln/SNYK-JS-STRONGNGINXCONTROLLER-564248
CVE ID: CVE-2020-7622 State: PUBLISHED Published: 2020-04-06T14:08:48.593894Z Last Updated: 2024-09-16T17:03:41.455Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: io.jooby:jooby-netty Problem Types: HTTP Response Splitting Description: This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249 - https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5
ps://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249 - https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4 - https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j
CVE ID: CVE-2020-7623 State: PUBLISHED Published: 2020-04-02T20:55:19 Last Updated: 2024-08-04T09:33:19.968Z Vendors: n/a Products: jscover Problem Types: Command Injection Description: jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/node-modules/jscover/blob/master/lib/jscover.js#L59%2C - https://snyk.io/vuln/SNYK-JS-JSCOVER-564250
CVE ID: CVE-2020-7624 State: PUBLISHED Published: 2020-04-02T21:03:16 Last Updated: 2024-08-04T09:33:20.016Z Vendors: n/a Products: effect Problem Types: Command Injection Description: effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Javascipt/effect/blob/master/helper.js#L24%2C - https://snyk.io/vuln/SNYK-JS-EFFECT-564256
CVE ID: CVE-2020-7625 State: PUBLISHED Published: 2020-04-02T21:19:57 Last Updated: 2024-08-04T09:33:19.991Z Vendors: n/a Products: op-browser Problem Types: Command Injection Description: op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hiproxy/open-browser/blob/master/lib/index.js#L75%2C - https://snyk.io/vuln/SNYK-JS-OPBROWSER-564259
CVE ID: CVE-2020-7626 State: PUBLISHED Published: 2020-04-02T21:23:34 Last Updated: 2024-08-04T09:33:19.994Z Vendors: n/a Products: karma-mojo Problem Types: Command Injection Description: karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/amireh/karma-mojo/blob/master/index.js#L100%2C - https://snyk.io/vuln/SNYK-JS-KARMAMOJO-564260
CVE ID: CVE-2020-7627 State: PUBLISHED Published: 2020-04-02T21:28:11 Last Updated: 2024-08-04T09:33:20.040Z Vendors: n/a Products: node-key-sender Problem Types: Command Injection Description: node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/garimpeiro-it/node-key-sender/blob/master/key-sender.js#L117%2C - https://snyk.io/vuln/SNYK-JS-NODEKEYSENDER-564261
CVE ID: CVE-2020-7628 State: PUBLISHED Published: 2020-04-02T21:33:25 Last Updated: 2024-08-04T09:33:19.969Z Vendors: n/a Products: install-package Problem Types: Command Injection Description: umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-UMOUNT-564265
CVE ID: CVE-2020-7629 State: PUBLISHED Published: 2020-04-02T21:38:31 Last Updated: 2024-08-04T09:33:19.988Z Vendors: n/a Products: install-package Problem Types: Command Injection Description: install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/1000ch/install-package/blob/master/index.js#L82%2C - https://snyk.io/vuln/SNYK-JS-INSTALLPACKAGE-564267
CVE ID: CVE-2020-7630 State: PUBLISHED Published: 2020-04-02T21:41:17 Last Updated: 2024-08-04T09:33:19.971Z Vendors: n/a Products: git-add-remote Problem Types: Command Injection Description: git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jonschlinkert/git-add-remote/blob/master/index.js#L21%2C - https://snyk.io/vuln/SNYK-JS-GITADDREMOTE-564269
CVE ID: CVE-2020-7631 State: PUBLISHED Published: 2020-04-06T12:18:39 Last Updated: 2024-08-04T09:33:19.974Z Vendors: n/a Products: diskusage-ng Problem Types: Command Injection Description: diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DISKUSAGENG-564425 - https://github.com/iximiuz/node-diskusage-ng/blob/master/lib/posix.js#L11
CVE ID: CVE-2020-7632 State: PUBLISHED Published: 2020-04-06T12:21:43 Last Updated: 2024-08-04T09:33:19.967Z Vendors: n/a Products: node-mpv Problem Types: Command Injection Description: node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEMPV-564426 - https://github.com/j-holub/Node-MPV/blob/master/lib/util.js#L34
CVE ID: CVE-2020-7633 State: PUBLISHED Published: 2020-04-06T12:24:12 Last Updated: 2024-08-04T09:33:20.008Z Vendors: n/a Products: apiconnect-cli-plugins Problem Types: Command Injection Description: apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-APICONNECTCLIPLUGINS-564427 - https://openbase.io/js/apiconnect-cli-plugins
CVE ID: CVE-2020-7634 State: PUBLISHED Published: 2020-04-06T12:27:11 Last Updated: 2024-08-04T09:33:19.987Z Vendors: n/a Products: heroku-addonpool Problem Types: Command Injection Description: heroku-addonpool through 0.1.15 is vulnerable to Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HEROKUADDONPOOL-564428 - https://github.com/nodef/heroku-addonpool/blob/master/index.js
CVE ID: CVE-2020-7635 State: PUBLISHED Published: 2020-04-06T12:29:26 Last Updated: 2024-08-04T09:33:20.026Z Vendors: n/a Products: compass-compile Problem Types: Command Injection Description: compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-COMPASSCOMPILE-564429 - https://github.com/quaertym/compass-compile/blob/master/lib/compass.js#L25
CVE ID: CVE-2020-7636 State: PUBLISHED Published: 2020-04-06T12:32:04 Last Updated: 2024-08-04T09:33:19.937Z Vendors: n/a Products: adb-driver Problem Types: Command Injection Description: adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ADBDRIVER-564430 - https://www.npmjs.com/package/adb-driver
CVE ID: CVE-2020-7637 State: PUBLISHED Published: 2020-04-06T12:34:54 Last Updated: 2024-08-04T09:33:19.944Z Vendors: n/a Products: class-transformer Problem Types: Prototype Pollution Description: class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typestack/class-transformer/commit/8f04eb9db02de708f1a20f6f2d2bb309b2fed01e - https://snyk.io/vuln/SNYK-JS-CLASSTRANSFORMER-564431
CVE ID: CVE-2020-7638 State: PUBLISHED Published: 2020-04-06T12:38:22 Last Updated: 2024-08-04T09:33:19.946Z Vendors: n/a Products: confinit Problem Types: Prototype Pollution Description: confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONFINIT-564433 - https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab
CVE ID: CVE-2020-7639 State: PUBLISHED Published: 2020-04-06T12:48:14 Last Updated: 2024-08-04T09:33:20.000Z Vendors: n/a Products: @eivifj/dot Problem Types: Prototype Pollution Description: eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EIVIFJDOT-564435 - https://github.com/eivindfjeldstad/dot/commit/774e4b0c97ca35d2ae40df2cd14428d37dd07a0b
CVE ID: CVE-2020-7640 State: PUBLISHED Published: 2020-04-27T21:34:45 Last Updated: 2024-08-04T09:33:19.982Z Vendors: n/a Products: pixl-class Problem Types: Arbitrary Code Execution Description: pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jhuckaby/pixl-class/commit/47677a3638e3583e42f3a05cc7f0b30293d2acc8%2C - https://snyk.io/vuln/SNYK-JS-PIXLCLASS-564968
CVE ID: CVE-2020-7641 State: PUBLISHED Published: 2022-07-17T08:40:09.666382Z Last Updated: 2024-09-17T03:52:56.207Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: grunt-util-property Problem Types: Prototype Pollution Description: This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-GRUNTUTILPROPERTY-565088 - https://github.com/mikaelkaron/grunt-util-property/blob/master/main.js%23L41
CVE ID: CVE-2020-7642 State: PUBLISHED Published: 2020-04-22T15:13:51 Last Updated: 2024-08-04T09:33:19.989Z Vendors: n/a Products: lazysizes Problem Types: n/a Description: lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LAZYSIZES-567144 - https://github.com/aFarkas/lazysizes/commit/3720ab8262552d4e063a38d8492f9490a231fd48
CVE ID: CVE-2020-7643 State: PUBLISHED Published: 2020-04-23T13:23:27 Last Updated: 2024-08-04T09:33:20.033Z Vendors: n/a Products: paypal-adaptive Problem Types: n/a Description: paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31 - https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089
CVE ID: CVE-2020-7644 State: PUBLISHED Published: 2020-04-28T18:27:45 Last Updated: 2024-08-04T09:33:20.025Z Vendors: n/a Products: fun-map Problem Types: Prototype Pollution Description: fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nathan7/fun-map/blob/master/index.js#L137%2C - https://snyk.io/vuln/SNYK-JS-FUNMAP-564436
CVE ID: CVE-2020-7645 State: PUBLISHED Published: 2020-05-02T15:25:12 Last Updated: 2024-08-04T09:33:20.031Z Vendors: n/a Products: chrome-launcher Problem Types: Command Injection Description: All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems. Additional Analyst Notes: - CVE Program Container: References: - http://snyk.io/vuln/SNYK-JS-CHROMELAUNCHER-537575
CVE ID: CVE-2020-7646 State: PUBLISHED Published: 2020-05-07T16:34:39 Last Updated: 2024-08-04T09:33:19.967Z Vendors: n/a Products: curlrequest Problem Types: Arbitrary File Read Description: curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CURLREQUEST-568274 - https://github.com/node-js-libs/curlrequest/blob/master/index.js#L239%2C
CVE ID: CVE-2020-7647 State: PUBLISHED Published: 2020-05-11T19:30:18 Last Updated: 2024-08-04T09:33:19.945Z Vendors: n/a Products: io.jooby:jooby and org.jooby:jooby Problem Types: Directory Traversal Description: All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806%2C - https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807%2C - https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
CVE ID: CVE-2020-7648 State: PUBLISHED Published: 2020-05-29T21:06:49 Last Updated: 2024-08-04T09:33:19.989Z Vendors: n/a Products: snyk-broker Problem Types: Arbitrary File Read Description: All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json` Additional Analyst Notes: - CVE Program Container: References: - https://updates.snyk.io/snyk-broker-security-fixes-152338 - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570607
CVE ID: CVE-2020-7649 State: PUBLISHED Published: 2022-07-25T14:07:24.823584Z Last Updated: 2024-09-16T20:12:04.419Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: snyk-broker Problem Types: Directory Traversal Description: This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608 - https://github.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429 - https://updates.snyk.io/snyk-broker-security-fixes-1
b.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429 - https://updates.snyk.io/snyk-broker-security-fixes-152338
CVE ID: CVE-2020-7650 State: PUBLISHED Published: 2020-05-29T21:11:39 Last Updated: 2024-08-04T09:33:19.992Z Vendors: n/a Products: snyk-broker Problem Types: Arbitrary File Read Description: All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json. Additional Analyst Notes: - CVE Program Container: References: - https://updates.snyk.io/snyk-broker-security-fixes-152338 - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570609
CVE ID: CVE-2020-7651 State: PUBLISHED Published: 2020-05-29T20:53:29 Last Updated: 2024-08-04T09:33:19.959Z Vendors: n/a Products: snyk-broker Problem Types: Arbitrary File Read Description: All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API. Additional Analyst Notes: - CVE Program Container: References: - https://updates.snyk.io/snyk-broker-security-fixes-152338 - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570610
CVE ID: CVE-2020-7652 State: PUBLISHED Published: 2020-05-29T20:46:35 Last Updated: 2024-08-04T09:33:19.957Z Vendors: n/a Products: snyk-broker Problem Types: Arbitrary File Read Description: All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://updates.snyk.io/snyk-broker-security-fixes-152338 - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570611
CVE ID: CVE-2020-7653 State: PUBLISHED Published: 2020-05-29T20:40:22 Last Updated: 2024-08-04T09:33:19.963Z Vendors: n/a Products: snyk-broker Problem Types: Arbitrary File Read Description: All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570612 - https://updates.snyk.io/snyk-broker-security-fixes-152338
CVE ID: CVE-2020-7654 State: PUBLISHED Published: 2020-05-29T21:09:15 Last Updated: 2024-08-04T09:33:20.023Z Vendors: n/a Products: snyk-broker Problem Types: Information Exposure Description: All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. Additional Analyst Notes: - CVE Program Container: References: - https://updates.snyk.io/snyk-broker-security-fixes-152338 - https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570613
CVE ID: CVE-2020-7655 State: PUBLISHED Published: 2020-05-21T14:15:54 Last Updated: 2024-08-04T09:33:20.004Z Vendors: n/a Products: netius Problem Types: HTTP Request Smuggling Description: netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141