Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7752 State: PUBLISHED Published: 2020-10-26T17:12:38.827301Z Last Updated: 2024-09-17T01:56:58.841Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: systeminformation Problem Types: Command Injection Description: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909 - https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
uln/SNYK-JS-SYSTEMINFORMATION-1021909 - https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js - https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61
CVE ID: CVE-2020-7753 State: PUBLISHED Published: 2020-10-27T08:15:15.542691Z Last Updated: 2024-09-16T22:03:06.008Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: trim Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TRIM-1017038 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1022132 - https://github.com/component/trim/blob/master/index.js%23L6 - https://lists.apache.org/thread.html/r75b8d0b88833d7d96afcdce3ead65e212572ead4e7a
onent/trim/blob/master/index.js%23L6 - https://lists.apache.org/thread.html/r75b8d0b88833d7d96afcdce3ead65e212572ead4e7a9f34d21040196%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/r10faad1ef9166d37a1a5c9142b1af7099b8ecdc5ad05c51b8ea993d9%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/r51ff3c2a4c7b8402f321eae7e624672cc2295c7bc8c12c8b871f6b0b%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/rb8462df3b6484e778905c09cd49a8912e1a302659860017ebe36da03%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/rcc7c2865a52b544a8e49386c6880e9b9ab29bfce1052b5569d09ee4a%40%3Ccommits.airflow.apache.org%3E
CVE ID: CVE-2020-7754 State: PUBLISHED Published: 2020-10-27T15:05:18.052022Z Last Updated: 2024-09-17T04:28:53.351Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: npm-user-validate Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NPMUSERVALIDATE-1019352 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019353 - https://github.com/npm/npm-user-validate/sec
ERVALIDATE-1019352 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019353 - https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p - https://github.com/npm/npm-user-validate/commit/c8a87dac1a4cc6988b5418f30411a8669bef204e
CVE ID: CVE-2020-7755 State: PUBLISHED Published: 2020-10-27T17:45:14.470320Z Last Updated: 2024-09-17T00:11:01.125Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: dat.gui Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DATGUI-1016275 - https://github.com/dataarts/dat.gui/issues/278
CVE ID: CVE-2020-7757 State: PUBLISHED Published: 2020-11-02T18:30:16.073327Z Last Updated: 2024-09-16T22:56:32.792Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: droppy Problem Types: Path Traversal Description: This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DROPPY-1023656 - https://github.com/silverwind/droppy/blob/master/server/server.js%23L845
CVE ID: CVE-2020-7758 State: PUBLISHED Published: 2020-11-02T18:30:22.046163Z Last Updated: 2024-09-16T20:42:47.740Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R) Vendors: n/a Products: browserless-chrome Problem Types: Path Traversal Description: This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 - https://gith
lyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 - https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175 - https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6 - https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable
CVE ID: CVE-2020-7759 State: PUBLISHED Published: 2020-10-30T10:55:12.920864Z Last Updated: 2024-09-16T18:33:50.152Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: pimcore/pimcore Problem Types: SQL Injection Description: The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+
p://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}] Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1017405 - https://github.com/pimcore/pimcore/pull/7315
CVE ID: CVE-2020-7760 State: PUBLISHED Published: 2020-10-30T11:10:32.942218Z Last Updated: 2024-09-17T01:06:44.297Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: codemirror, org.apache.marmotta.webjars:codemirror Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-
865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)* Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1024445 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCOMPONENTS-1024446 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1024447 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCODEMIRROR-1024448 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1024449 - https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450 - https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ff
o/vuln/SNYK-JAVA-ORGAPACHEMARMOTTAWEBJARS-1024450 - https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae8824705993bbb - https://www.debian.org/security/2020/dsa-4789 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2020-7761 State: PUBLISHED Published: 2020-11-05T10:25:10.337354Z Last Updated: 2024-09-17T01:11:54.962Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: @absolunet/kafe Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ABSOLUNETKAFE-1017403 - https://github.com/absolunet/kafe/commit/c644c798bfcdc1b0bbb1f0ca59e2e2664ff3fdd0%23diff-f0f4b5b19ad46588ae9d7dc1889f681252b0698a4ead3a77b7c7d127ee6
/kafe/commit/c644c798bfcdc1b0bbb1f0ca59e2e2664ff3fdd0%23diff-f0f4b5b19ad46588ae9d7dc1889f681252b0698a4ead3a77b7c7d127ee657857
CVE ID: CVE-2020-7762 State: PUBLISHED Published: 2020-11-05T12:30:14.703783Z Last Updated: 2024-09-17T01:56:48.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: jsreport-chrome-pdf Problem Types: Arbitrary File Read Description: This affects the package jsreport-chrome-pdf before 1.10.0. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSREPORTCHROMEPDF-1037310 - https://github.com/jsreport/jsreport-chrome-pdf/commit/6750b2f77d05cb843aefc1c4a98097a3bd33a6a2
CVE ID: CVE-2020-7763 State: PUBLISHED Published: 2020-11-05T13:25:13.225273Z Last Updated: 2024-09-16T20:21:29.586Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: phantom-html-to-pdf Problem Types: Arbitrary File Read Description: This affects the package phantom-html-to-pdf before 0.6.1. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PHANTOMHTMLTOPDF-1023598 - https://github.com/pofider/phantom-html-to-pdf/commit/b5d2da2639a49a95e0bdb3bc0c987cb6406b8259
CVE ID: CVE-2020-7764 State: PUBLISHED Published: 2020-11-08T15:50:12.276340Z Last Updated: 2024-09-17T03:12:48.081Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: find-my-way Problem Types: Web Cache Poisoning Description: This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269 - https://
ditional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FINDMYWAY-1038269 - https://github.com/delvedor/find-my-way/commit/ab408354690e6b9cf3c4724befb3b3fa4bb90aac
CVE ID: CVE-2020-7765 State: PUBLISHED Published: 2020-11-16T12:00:17.953638Z Last Updated: 2024-09-17T01:05:55.551Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: @firebase/util Problem Types: Prototype Pollution Description: This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324 - https://github.com/firebase/firebase-js-sdk
Container: References: - https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324 - https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada - https://github.com/firebase/firebase-js-sdk/pull/4001
CVE ID: CVE-2020-7766 State: PUBLISHED Published: 2020-11-10T15:35:15.894341Z Last Updated: 2024-09-16T22:14:07.645Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: json-ptr Problem Types: Prototype Pollution Description: This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - h
the key being set, leading to a prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSONPTR-1016939 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038396 - https://github.com/flitbit/json-ptr/blob/master/src/util.ts%23L174
CVE ID: CVE-2020-7767 State: PUBLISHED Published: 2020-11-11T10:20:21.655516Z Last Updated: 2024-09-16T19:25:17.261Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: express-validators Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EXPRESSVALIDATORS-1017404
CVE ID: CVE-2020-7768 State: PUBLISHED Published: 2020-11-11T10:20:16.848643Z Last Updated: 2024-09-17T00:01:51.703Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: grpc, @grpc/grpc-js Problem Types: Prototype Pollution Description: The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GRPC-598671 - https://snyk.io/vuln/SNYK-JS-GRPCGRPCJS-1038818 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819 - https://github.com/grpc/grpc-node/pull/1605 - https://gith
8818 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038819 - https://github.com/grpc/grpc-node/pull/1605 - https://github.com/grpc/grpc-node/pull/1606
CVE ID: CVE-2020-7769 State: PUBLISHED Published: 2020-11-12T08:30:17.442903Z Last Updated: 2024-09-16T18:50:22.395Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: nodemailer Problem Types: Command Injection Description: This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742 - https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9b
ps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742 - https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75 - https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54
CVE ID: CVE-2020-7770 State: PUBLISHED Published: 2020-11-12T10:15:16.741097Z Last Updated: 2024-09-16T20:42:54.969Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: n/a Products: json8 Problem Types: Prototype Pollution Description: This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSON8-1017116 - https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e
CVE ID: CVE-2020-7771 State: PUBLISHED Published: 2021-01-04T11:50:13.186021Z Last Updated: 2024-09-17T02:57:29.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: asciitable.js Problem Types: Prototype Pollution Description: The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ASCIITABLEJS-1039799 - https://github.com/victornpb/asciitable.js/pull/1
CVE ID: CVE-2020-7772 State: PUBLISHED Published: 2020-11-15T15:10:12.852296Z Last Updated: 2024-09-17T02:47:10.543Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: doc-path Problem Types: Prototype Pollution Description: This affects the package doc-path before 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOCPATH-1011952 - https://github.com/mrodrig/doc-path/blob/stable/src/path.js%23L54 - https://github.com/mrodrig/doc-path/commit/3e2bb168cf303bffcd7fae5f8d05e5300c1541c7
CVE ID: CVE-2020-7773 State: PUBLISHED Published: 2020-11-16T12:00:24.377702Z Last Updated: 2024-09-16T22:09:13.146Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: markdown-it-highlightjs Problem Types: Cross-site Scripting (XSS) Description: This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}')
('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss); Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461 - https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14 - https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52
CVE ID: CVE-2020-7774 State: PUBLISHED Published: 2020-11-17T12:30:20.482040Z Last Updated: 2024-09-16T20:13:29.664Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: y18n Problem Types: Prototype Pollution Description: The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-Y18N-1021887 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306 - https://github.com/yargs/y18n/pull/108 - https://github.com/yargs/y18n/issues/96 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://cert-portal.siemens.com/productcer
rgs/y18n/issues/96 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2020-7775 State: PUBLISHED Published: 2021-02-02T18:20:14.515804Z Last Updated: 2024-09-17T00:42:36.739Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: freediskspace Problem Types: Command Injection Description: This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FREEDISKSPACE-1040716
CVE ID: CVE-2020-7776 State: PUBLISHED Published: 2020-12-09T16:45:18.358373Z Last Updated: 2024-09-16T19:39:56.390Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: phpoffice/phpspreadsheet Problem Types: Cross-site Scripting (XSS) Description: This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98
of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856 - https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845 - https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792
CVE ID: CVE-2020-7777 State: PUBLISHED Published: 2020-11-23T15:40:15.585078Z Last Updated: 2024-09-17T01:01:16.176Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: jsen Problem Types: Arbitrary Code Execution Description: This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the sche
ticular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSEN-1014670 - https://github.com/bugventure/jsen/blob/master/lib/jsen.js%23L875
CVE ID: CVE-2020-7778 State: PUBLISHED Published: 2020-11-26T10:40:14.404396Z Last Updated: 2024-09-16T20:53:12.158Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O) Vendors: n/a Products: systeminformation Problem Types: Prototype Pollution Description: This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js - https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753 - https://gist.github.com/EffectRenan/b4344
ter/lib/internet.js - https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753 - https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80 - https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc - https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
CVE ID: CVE-2020-7779 State: PUBLISHED Published: 2020-11-26T10:20:13.851079Z Last Updated: 2024-09-16T16:33:56.880Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: djvalidator Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DJVALIDATOR-1018709