Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://github.com/ardatan/graphql-tools/commit/6a966beee8ca8b2f4adfe93318b96e4a5c501eac - https://github.com/ardatan/graphql-tools/pull/2470 - https://github.com/ardatan/graphql-tools/releases/tag/%40graphql-tools%2Fgit-loader%406.2.6 - https://advisory.checkmarx.net/advisory/CX-2020-4300
CVE ID: CVE-2021-23327 State: PUBLISHED Published: 2021-02-09T08:10:16.850370Z Last Updated: 2024-09-17T02:51:43.351Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O) Vendors: n/a Products: apexcharts Problem Types: Cross-site Scripting (XSS) Description: The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-APEXCHARTS-1062708 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1070616 - https://github.com/apexcharts/apexcharts.js/commit/68f3f34d125719b4767614fe0a595cc65bde1d19 - https://github.c
1070616 - https://github.com/apexcharts/apexcharts.js/commit/68f3f34d125719b4767614fe0a595cc65bde1d19 - https://github.com/apexcharts/apexcharts.js/pull/2158
CVE ID: CVE-2021-23328 State: PUBLISHED Published: 2021-01-29T16:15:18.174997Z Last Updated: 2024-09-17T01:42:00.544Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: iniparserjs Problem Types: Prototype Pollution Description: This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-INIPARSERJS-1065989 - https://www.npmjs.com/package/iniparserjs
CVE ID: CVE-2021-23329 State: PUBLISHED Published: 2021-01-31T15:25:14.923617Z Last Updated: 2024-09-16T16:32:38.564Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: nested-object-assign Problem Types: Prototype Pollution Description: The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NESTEDOBJECTASSIGN-1065977 - https://github.com/Geta/NestedObjectAssign/pull/11
CVE ID: CVE-2021-23330 State: PUBLISHED Published: 2021-02-01T15:05:16.787092Z Last Updated: 2024-09-17T04:04:33.394Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: launchpad Problem Types: Command Injection Description: All versions of package launchpad are vulnerable to Command Injection via stop. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LAUNCHPAD-1044065 - https://github.com/bitovi/launchpad/issues/123%23issuecomment-732188118 - https://github.com/bitovi/launchpad/pull/124
CVE ID: CVE-2021-23331 State: PUBLISHED Published: 2021-02-03T18:05:15.486273Z Last Updated: 2024-09-16T18:33:55.471Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C) Vendors: n/a Products: com.squareup:connect Problem Types: Insecure Temporary File Description: This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workar
ents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUP-1065988 - https://github.com/square/connect-java-sdk/blob/master/src/main/java/com/squareup/connect/ApiClient.java%23L613
CVE ID: CVE-2021-23334 State: REJECTED Published: 2021-02-11T11:25:16 Last Updated: 2021-06-11T21:18:23 Description: No description available.
CVE ID: CVE-2021-23335 State: PUBLISHED Published: 2021-02-11T11:25:12.018791Z Last Updated: 2024-09-16T20:47:44.882Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: is-user-valid Problem Types: LDAP Injection Description: All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ISUSERVALID-1056766
CVE ID: CVE-2021-23336 State: PUBLISHED Published: 2021-02-15T12:15:20.788790Z Last Updated: 2024-09-16T18:55:19.315Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: python/cpython Problem Types: Web Cache Poisoning Description: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the reque
cker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 - https://github.com/python/cpython/pull/24297 - https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ - http://www.openwall.com/lists/oss-security/2021
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ - http://www.openwall.com/lists/oss-security/2021/02/19/4 - https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN
PSCIMSZIA5IZZ62/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/ - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/ - https://lists.fedoraproj
ves/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46F
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/ - https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html - https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/ - https://security.gentoo.org/glsa/202104-04 - https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/05/01/2 - https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5
ttp://www.openwall.com/lists/oss-security/2021/05/01/2 - https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20210326-0004/ - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.co
le.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
CVE ID: CVE-2021-23337 State: PUBLISHED Published: 2021-02-15T12:15:14.715164Z Last Updated: 2024-09-16T19:15:17.074Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: Lodash Problem Types: Command Injection Description: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LODASH-1040724 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITH
JARSNPM-1074929 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 - https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932 - https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210312-0006/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
CVE ID: CVE-2021-23338 State: PUBLISHED Published: 2021-02-15T15:50:15.795765Z Last Updated: 2024-09-16T17:49:26.778Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: n/a Products: qlib Problem Types: Deserialization of Untrusted Data Description: This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-QLIB-1054635 - https://github.com/418sec/huntr/pull/1329
CVE ID: CVE-2021-23339 State: PUBLISHED Published: 2021-02-17T07:55:14.049399Z Last Updated: 2024-09-16T20:23:01.801Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: com.typesafe.akka:akka-http-core Problem Types: HTTP Request Smuggling Description: This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043 - https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201
CVE ID: CVE-2021-23340 State: PUBLISHED Published: 2021-02-18T14:25:14.352339Z Last Updated: 2024-09-17T03:43:54.860Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:F/RL:O/RC:C) Vendors: n/a Products: pimcore/pimcore Problem Types: Local File Inclusion Description: This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since expor
a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1070132 - https://github.com/pimcore/pimcore/blob/v6.7.2/bundles/AdminBundle/Controller/Reports/CustomReportController.php%23L454 - https://github.com/pimcore/pimcore/commit/1786bdd4962ee51544fad537352c2b4223309442
CVE ID: CVE-2021-23341 State: PUBLISHED Published: 2021-02-18T16:00:29.799313Z Last Updated: 2024-09-16T19:56:25.729Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: prismjs Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583 - https://github.c
ps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583 - https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609 - https://github.com/PrismJS/prism/issues/2583 - https://github.com/PrismJS/prism/pull/2584
CVE ID: CVE-2021-23342 State: PUBLISHED Published: 2021-02-19T16:35:15.574977Z Last Updated: 2024-09-16T22:39:56.584Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: docsify Problem Types: Cross-site Scripting (XSS) Description: This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters Additional Anal
ng place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593 - https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe - http://seclists.org/fulldisclosure/2021/Feb/71 - http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html
CVE ID: CVE-2021-23343 State: PUBLISHED Published: 2021-05-04T08:25:17.431572Z Last Updated: 2024-09-16T22:14:48.595Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: path-parse Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028 - https://gith
: - https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028 - https://github.com/jbgutierrez/path-parse/issues/8 - https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85%40%3Cdev.myfaces.apache.org%3E
CVE ID: CVE-2021-23344 State: PUBLISHED Published: 2021-03-04T16:55:14.189145Z Last Updated: 2024-09-17T01:55:53.280Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: total.js Problem Types: Remote Code Execution (RCE) Description: The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TOTALJS-1077069 - https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04
CVE ID: CVE-2021-23345 State: PUBLISHED Published: 2021-02-26T17:20:17.953960Z Last Updated: 2024-09-16T17:17:42.907Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: github.com/thecodingmachine/gotenberg Problem Types: Server-side Request Forgery (SSRF) Description: All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTHECODINGMAC
Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTHECODINGMACHINEGOTENBERG-1062043 - https://github.com/thecodingmachine/gotenberg/issues/261
CVE ID: CVE-2021-23346 State: PUBLISHED Published: 2021-03-04T16:55:21.677886Z Last Updated: 2024-09-16T17:24:19.050Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:R) Vendors: n/a Products: html-parse-stringify, html-parse-stringify2 Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306 -
ditional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY-1079306 - https://snyk.io/vuln/SNYK-JS-HTMLPARSESTRINGIFY2-1079307 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1080633 - https://github.com/rayd/html-parse-stringify2/blob/master/lib/parse.js%23L2 - https://github.com/HenrikJoreteg/html-parse-stringify/blob/master/lib/parse.js%23L2 - https://github.com/HenrikJoreteg/html-parse-stringify/commit/c7274a48e59c92b2b7e906fedf9065159e73fe12
CVE ID: CVE-2021-23347 State: PUBLISHED Published: 2021-03-03T09:55:25.235231Z Last Updated: 2024-09-17T04:14:06.008Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: github.com/argoproj/argo-cd/cmd Problem Types: Cross-site Scripting (XSS) Description: The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 - https://g
: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 - https://github.com/argoproj/argo-cd/pull/5563
CVE ID: CVE-2021-23348 State: PUBLISHED Published: 2021-03-31T14:25:17.671837Z Last Updated: 2024-09-16T20:52:54.111Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: portprocesses Problem Types: Arbitrary Command Injection Description: This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PORTPROCESSES-1078536 - https://github.com/rrai
tes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PORTPROCESSES-1078536 - https://github.com/rrainn/PortProcesses/blob/fffceb09aff7180afbd0bd172e820404b33c8299/index.js%23L23 - https://github.com/rrainn/PortProcesses/security/advisories/GHSA-vm67-7vmg-66vm - https://github.com/rrainn/PortProcesses/commit/86811216c9b97b01b5722f879f8c88a7aa4214e1
CVE ID: CVE-2021-23351 State: PUBLISHED Published: 2021-03-08T04:45:23.830953Z Last Updated: 2024-09-17T01:31:07.953Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: github.com/pires/go-proxyproto Problem Types: Denial of Service (DoS) Description: The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using
e implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577 - https://github.com/pires/go-proxyproto/pull/71 - https://github.com/pires/go-proxyproto/issues/69 - https://github.com/pires/go-proxyproto/commit/7f4
roxyproto/pull/71 - https://github.com/pires/go-proxyproto/issues/69 - https://github.com/pires/go-proxyproto/commit/7f48261db810703d173f27f3309a808cc2b49b8b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BNVGJMVI3ZTZ675EFPUHPGXCKCGSX46/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36IBVOZXRTWM7MGTRUTOM56P5RR74VU/