Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7716 State: PUBLISHED Published: 2020-09-01T09:20:12.116704Z Last Updated: 2024-09-17T03:54:18.999Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: deeps Problem Types: Prototype Pollution Description: All versions of package deeps are vulnerable to Prototype Pollution via the set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DEEPS-598667
CVE ID: CVE-2020-7717 State: PUBLISHED Published: 2020-09-01T09:25:15.747263Z Last Updated: 2024-09-16T23:46:58.986Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: dot-notes Problem Types: Prototype Pollution Description: All versions of package dot-notes are vulnerable to Prototype Pollution via the create function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOTNOTES-598668
CVE ID: CVE-2020-7718 State: PUBLISHED Published: 2020-09-01T09:25:11.809398Z Last Updated: 2024-09-16T22:25:24.101Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: gammautils Problem Types: Prototype Pollution Description: All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GAMMAUTILS-598670
CVE ID: CVE-2020-7719 State: PUBLISHED Published: 2020-09-01T09:30:14.672074Z Last Updated: 2024-09-17T01:26:21.769Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: locutus Problem Types: Prototype Pollution Description: Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LOCUTUS-598675 - https://github.com/kvz/locutus/pull/418/
CVE ID: CVE-2020-7720 State: PUBLISHED Published: 2020-09-01T09:35:12.869324Z Last Updated: 2024-09-16T17:49:31.304Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: node-forge Problem Types: Prototype Pollution Description: The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293 - https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md
CVE ID: CVE-2020-7721 State: PUBLISHED Published: 2020-09-01T09:40:16.163280Z Last Updated: 2024-09-16T18:09:04.398Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: node-oojs Problem Types: Prototype Pollution Description: All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEOOJS-598678
CVE ID: CVE-2020-7722 State: PUBLISHED Published: 2020-09-01T09:40:12.396370Z Last Updated: 2024-09-16T23:40:34.776Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: nodee-utils Problem Types: Prototype Pollution Description: All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEEUTILS-598679
CVE ID: CVE-2020-7723 State: PUBLISHED Published: 2020-09-01T09:45:17.168625Z Last Updated: 2024-09-16T17:09:16.209Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: promisehelpers Problem Types: Prototype Pollution Description: All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PROMISEHELPERS-598686
CVE ID: CVE-2020-7724 State: PUBLISHED Published: 2020-09-01T09:45:13.481701Z Last Updated: 2024-09-16T23:11:03.099Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: tiny-conf Problem Types: Prototype Pollution Description: All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TINYCONF-598792
CVE ID: CVE-2020-7725 State: PUBLISHED Published: 2020-09-01T09:50:19.423784Z Last Updated: 2024-09-16T22:46:09.711Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: worksmith Problem Types: Prototype Pollution Description: All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-WORKSMITH-598798
CVE ID: CVE-2020-7726 State: PUBLISHED Published: 2020-09-01T09:50:15.412809Z Last Updated: 2024-09-17T00:00:32.726Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: safe-object2 Problem Types: Prototype Pollution Description: All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SAFEOBJECT2-598801
CVE ID: CVE-2020-7727 State: PUBLISHED Published: 2020-09-01T09:50:11.729458Z Last Updated: 2024-09-16T17:38:15.864Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: gedi Problem Types: Prototype Pollution Description: All versions of package gedi are vulnerable to Prototype Pollution via the set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GEDI-598803
CVE ID: CVE-2020-7729 State: PUBLISHED Published: 2020-09-03T09:00:15.371797Z Last Updated: 2024-09-17T01:45:50.965Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O) Vendors: n/a Products: grunt Problem Types: Arbitrary Code Execution Description: The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GRUNT-597546 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 - https://github.com/gruntjs/grunt/blob/master
NYK-JS-GRUNT-597546 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-607922 - https://github.com/gruntjs/grunt/blob/master/lib/grunt/file.js%23L249 - https://github.com/gruntjs/grunt/commit/e350cea1724eb3476464561a380fb6a64e61e4e7 - https://lists.debian.org/debian-lts-announce/2020/09/msg00008.html - https://usn.ubuntu.com/4595-1/
CVE ID: CVE-2020-7730 State: PUBLISHED Published: 2020-09-04T09:30:14.880642Z Last Updated: 2024-09-16T16:18:28.379Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: bestzip Problem Types: Command Injection Description: The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BESTZIP-609371 - https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6
CVE ID: CVE-2020-7731 State: PUBLISHED Published: 2021-04-30T16:10:13.540269Z Last Updated: 2024-09-17T03:07:42.489Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: github.com/russellhaering/gosaml2 Problem Types: Denial of Service (DoS) Description: This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOSAML2-608302 - https://github.com/russellhaering/gosaml2/issues/59 - https://github.com/russellhaering/gosaml
LLHAERINGGOSAML2-608302 - https://github.com/russellhaering/gosaml2/issues/59 - https://github.com/russellhaering/gosaml2/releases/tag/v0.7.0
CVE ID: CVE-2020-7733 State: PUBLISHED Published: 2020-09-16T14:10:14.452881Z Last Updated: 2024-09-17T04:00:09.605Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: ua-parser-js Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666 - https://
io/vuln/SNYK-JAVA-ORGWEBJARSNPM-674665 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBFAISALMAN-674666 - https://github.com/faisalman/ua-parser-js/commit/233d3bae22a795153a7e6638887ce159c63e557d - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-7734 State: PUBLISHED Published: 2020-09-22T08:00:24.357097Z Last Updated: 2024-09-16T16:28:01.749Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:F) Vendors: n/a Products: cabot Problem Types: Cross-site Scripting (XSS) Description: All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column. Additional Analyst Notes: - CVE Program Container: References: - https://itsmeanonartist.tech/blogs/blog2.html - https://snyk.io/vuln/SNYK-PYTHON-CABOT-609862 - https://github.com/arachnys/cabot/pull/694 - https://www.exploit-db.com/exploits/48791
CVE ID: CVE-2020-7735 State: PUBLISHED Published: 2020-09-25T12:10:15.254360Z Last Updated: 2024-09-16T20:11:24.291Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: ng-packagr Problem Types: Command Injection Description: The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NGPACKAGR-1012427 - https://github.com/ng-packagr/ng-packagr/commit/bda0fff3443301f252930a73fdc8fb9502de596d
CVE ID: CVE-2020-7736 State: PUBLISHED Published: 2020-10-02T09:25:12.523126Z Last Updated: 2024-09-16T18:55:47.667Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: bmoor Problem Types: Prototype Pollution Description: The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BMOOR-598664 - https://github.com/b-heilman/bmoor/commit/7d4a086a1dc3ef11ed0b323824d02348734b7da5
CVE ID: CVE-2020-7737 State: PUBLISHED Published: 2020-10-02T09:30:13.280639Z Last Updated: 2024-09-16T23:10:37.593Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: safetydance Problem Types: Prototype Pollution Description: All versions of package safetydance are vulnerable to Prototype Pollution via the set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SAFETYDANCE-598687
CVE ID: CVE-2020-7738 State: PUBLISHED Published: 2020-10-02T10:05:13.792182Z Last Updated: 2024-09-17T02:11:06.591Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: n/a Products: shiba Problem Types: Arbitrary Code Execution Description: All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad(). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SHIBA-596466
CVE ID: CVE-2020-7739 State: PUBLISHED Published: 2020-10-06T15:10:12.999286Z Last Updated: 2024-09-17T00:56:09.101Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: phantomjs-seo Problem Types: Server-side Request Forgery (SSRF) Description: This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PHANTOMJSSEO-609638 - https://github.com/areverberi/phantomjs-seo/blob/083f66892f97d67031668decb917389ffc32a94c/index.js%23L17
CVE ID: CVE-2020-7740 State: PUBLISHED Published: 2020-10-06T16:40:13.357329Z Last Updated: 2024-09-17T03:52:44.294Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: node-pdf-generator Problem Types: Server-side Request Forgery (SSRF) Description: This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636 -
Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636 - https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29
CVE ID: CVE-2020-7741 State: PUBLISHED Published: 2020-10-06T14:30:15.993746Z Last Updated: 2024-09-16T16:42:49.723Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: n/a Products: hellojs Problem Types: Cross-site Scripting (XSS) Description: This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546 - https://github.com/MrSwitch/hello.js/blob/3b
ram Container: References: - https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546 - https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545 - https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669
CVE ID: CVE-2020-7742 State: PUBLISHED Published: 2020-10-07T08:55:12.285385Z Last Updated: 2024-09-17T01:51:22.313Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: simpl-schema Problem Types: Prototype Pollution Description: This affects the package simpl-schema before 1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SIMPLSCHEMA-1016157 - https://github.com/aldeed/simpl-schema/blob/main/package/lib/utility/merge.js
CVE ID: CVE-2020-7743 State: PUBLISHED Published: 2020-10-13T09:15:16.908892Z Last Updated: 2024-09-16T19:31:25.554Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: mathjs Problem Types: Prototype Pollution Description: The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MATHJS-1016401 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1017111 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1017112 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1017113 - https://github.com/josd
.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1017112 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1017113 - https://github.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82 - https://github.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e
CVE ID: CVE-2020-7744 State: PUBLISHED Published: 2020-10-15T12:40:13.635193Z Last Updated: 2024-09-17T02:53:29.652Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: n/a Products: com.mintegral.msdk:alphab Problem Types: Information Exposure Description: This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download m
le Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/research/sour-mint-malicious-sdk/ - https://snyk.io/vuln/SNYK-JAVA-COMMINTEGRALMSDK-1018714 - https://snyk.io/blog/remote-code-e
/sour-mint-malicious-sdk/ - https://snyk.io/vuln/SNYK-JAVA-COMMINTEGRALMSDK-1018714 - https://snyk.io/blog/remote-code-execution-rce-sourmint/
CVE ID: CVE-2020-7745 State: PUBLISHED Published: 2020-10-19T09:55:14.678156Z Last Updated: 2024-09-17T02:42:27.106Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C) Vendors: n/a Products: MintegralAdSDK Problem Types: Malicious Package Description: This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/blog/remote-code-execution-rce-sourmint/ - https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRA
r: References: - https://snyk.io/blog/remote-code-execution-rce-sourmint/ - https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-1019377 - https://snyk.io/research/sour-mint-malicious-sdk/%23rce - https://www.youtube.com/watch?v=n-mEMkeoUqs
CVE ID: CVE-2020-7746 State: PUBLISHED Published: 2020-10-29T08:05:17.720774Z Last Updated: 2024-09-16T19:25:49.326Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: chart.js Problem Types: Prototype Pollution Description: This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution. Additional Analyst Notes: - CVE Program Container: References: -
set are not checked, leading to a prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CHARTJS-1018716 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019374 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1019375 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCHARTJS-1019376 - https://github.com/chartjs/Chart.js/pull/7920
CVE ID: CVE-2020-7747 State: PUBLISHED Published: 2020-10-20T10:25:15.016632Z Last Updated: 2024-09-16T16:42:28.588Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: lightning-server Problem Types: Cross-site Scripting (XSS) Description: This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381 - https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
CVE ID: CVE-2020-7748 State: PUBLISHED Published: 2020-10-20T10:25:21.517519Z Last Updated: 2024-09-17T02:53:19.004Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: @tsed/core Problem Types: Prototype Pollution Description: This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382 - https://github.com/TypedProject/tsed/
E Program Container: References: - https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382 - https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36 - https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b
CVE ID: CVE-2020-7749 State: PUBLISHED Published: 2020-10-20T10:25:26.929315Z Last Updated: 2024-09-16T16:28:47.401Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:R) Vendors: n/a Products: osm-static-maps Problem Types: Server-side Request Forgery (SSRF) Description: This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity
s an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-OSMSTATICMAPS-609637 - https://github.com/jperelli/osm-static-maps/blob/master/src/template.html%23L142 - https://github.com/jperelli/osm-static-maps/pull/24
CVE ID: CVE-2020-7750 State: PUBLISHED Published: 2020-10-21T16:20:12.796054Z Last Updated: 2024-09-16T19:31:46.720Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: scratch-svg-renderer Problem Types: Cross-site Scripting (XSS) Description: This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497 - https://github.com/LLK/scratch-svg-renderer/c
r: References: - https://snyk.io/vuln/SNYK-JS-SCRATCHSVGRENDERER-1020497 - https://github.com/LLK/scratch-svg-renderer/commit/9ebf57588aa596c4fa3bb64209e10ade395aee90
CVE ID: CVE-2020-7751 State: PUBLISHED Published: 2020-10-25T15:55:14.667611Z Last Updated: 2024-09-16T19:30:09.875Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: pathval Problem Types: Prototype Pollution Description: pathval before version 1.1.1 is vulnerable to prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PATHVAL-596926 - https://github.com/chaijs/pathval/pull/58/files