Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-2342653 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2348246 - https://github.com/ashaffer/cached-path-relative/commit/40c73bf70c58add5aec7d11e4f36b93d144bb760 - https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html
CVE ID: CVE-2021-23520 State: PUBLISHED Published: 2022-01-31T10:56:15.581682Z Last Updated: 2024-09-16T22:46:03.250Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/research/zip-slip-vulnerability - https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRA
m Container: References: - https://snyk.io/research/zip-slip-vulnerability - https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607 - https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f
CVE ID: CVE-2021-23521 State: PUBLISHED Published: 2022-01-31T10:50:34.104027Z Last Updated: 2024-09-17T02:51:34.161Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and
acker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f - https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388608
CVE ID: CVE-2021-23543 State: PUBLISHED Published: 2022-01-07T20:05:19.701202Z Last Updated: 2024-09-16T20:06:18.093Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: realms-shim Problem Types: Sandbox Bypass Description: All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/realms-shim - https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309908
CVE ID: CVE-2021-23555 State: PUBLISHED Published: 2022-02-11T20:00:14.189158Z Last Updated: 2024-09-16T17:23:55.888Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: vm2 Problem Types: Sandbox Bypass Description: The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-VM2-2309905 - https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d
CVE ID: CVE-2021-23556 State: PUBLISHED Published: 2022-03-17T11:20:43.711518Z Last Updated: 2024-09-17T02:12:07.625Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P) Vendors: n/a Products: guake Problem Types: Exposed Dangerous Method or Function Description: The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run
Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Guake/guake/issues/1796 - https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334 - https://github.com/Guake/guake/pull/2017 - https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888 - https://github.com/Guake/guake/releases
CVE ID: CVE-2021-23558 State: PUBLISHED Published: 2022-01-28T21:31:31.186105Z Last Updated: 2024-09-16T16:23:32.600Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: n/a Problem Types: n/a Description: The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BMOOR-2342622 - https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b - https:/
uln/SNYK-JS-BMOOR-2342622 - https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b - https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/
CVE ID: CVE-2021-23561 State: PUBLISHED Published: 2021-12-10T20:05:10.380553Z Last Updated: 2024-09-17T00:51:09.796Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: comb Problem Types: Prototype Pollution Description: All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-COMB-1730083
CVE ID: CVE-2021-23562 State: PUBLISHED Published: 2021-12-03T20:00:13.011037Z Last Updated: 2024-09-16T17:52:55.304Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: plupload Problem Types: Arbitrary File Upload Description: This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664 - htt
.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665 - https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226 - https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb
CVE ID: CVE-2021-23566 State: PUBLISHED Published: 2022-01-14T20:05:21.597Z Last Updated: 2025-11-03T21:44:38.677Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: nanoid Problem Types: Information Exposure Description: The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NANOID-2332193 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550 - https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444 - https://github.com/ai/nanoid/commit
JARSNPM-2332550 - https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444 - https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575 - https://github.com/ai/nanoid/pull/328
CVE ID: CVE-2021-23567 State: PUBLISHED Published: 2022-01-14T20:05:12.771288Z Last Updated: 2024-09-16T22:45:02.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: colors Problem Types: Denial of Service (DoS) Description: The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i
appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-COLORS-2331906 - https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18 - https://github.com/Marak/colors.js/issues/285 - https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640 - https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what/
CVE ID: CVE-2021-23568 State: PUBLISHED Published: 2022-01-07T20:05:13.398458Z Last Updated: 2024-09-16T17:54:22.698Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: extend2 Problem Types: Prototype Pollution Description: The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EXTEND2-2320315 - https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60 - https://github.com/eggjs/extend2/commit/aa332a59116c8398976434b57ea477c6823054f8 - https://github.com/eggjs/extend2/pull/2
CVE ID: CVE-2021-23574 State: PUBLISHED Published: 2021-12-24T20:00:18.183901Z Last Updated: 2024-09-16T20:16:46.579Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O) Vendors: n/a Products: js-data Problem Types: Prototype Pollution Description: All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSDATA-1584361 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2320790 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-232079
A-1584361 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2320790 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2320791 - https://github.com/js-data/js-data/issues/576 - https://github.com/js-data/js-data/blob/master/dist/js-data.js%23L472 - https://github.com/js-data/js-data/issues/577
CVE ID: CVE-2021-23592 State: PUBLISHED Published: 2022-05-06T20:05:17.579406Z Last Updated: 2024-09-16T16:22:51.483Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P) Vendors: n/a Products: topthink/framework Problem Types: Deserialization of Untrusted Data Description: The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695 - https://github.com/top-think/framework/releases/tag/v6.0.12 - https://github.com/top-think/framework/commit/d3b5aeae94bc71bae97
/github.com/top-think/framework/releases/tag/v6.0.12 - https://github.com/top-think/framework/commit/d3b5aeae94bc71bae97977d05cd12c3e0550905c
CVE ID: CVE-2021-23594 State: PUBLISHED Published: 2022-01-07T20:00:15.407735Z Last Updated: 2024-09-17T01:51:35.420Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: realms-shim Problem Types: Sandbox Bypass Description: All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-REALMSSHIM-2309907 - https://www.npmjs.com/package/realms-shim
CVE ID: CVE-2021-23597 State: PUBLISHED Published: 2022-02-11T17:05:13.098850Z Last Updated: 2024-09-16T16:58:20.158Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: fastify-multipart Problem Types: Denial of Service (DoS) Description: This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480 - https://github.com/fastify/fastify-mul
Container: References: - https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480 - https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066 - https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1
CVE ID: CVE-2021-23624 State: PUBLISHED Published: 2021-11-03T17:20:16.037662Z Last Updated: 2024-09-16T19:20:13.635Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:C) Vendors: n/a Products: dotty Problem Types: Prototype Pollution Description: This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOTTY-1577292 - https://github.com/deoxxa/dotty/commit/88f61860dcc274a07a263c32cbe9d44c24ef02d7
CVE ID: CVE-2021-23631 State: PUBLISHED Published: 2022-01-21T20:05:23.621124Z Last Updated: 2024-09-16T18:07:59.806Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: convert-svg-core, convert-svg-to-png, convert-svg-to-jpeg Problem Types: Directory Traversal Description: This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/v
file content as a converted PNG file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-1582785 - https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOPNG-2348244 - https://snyk.io/vuln/SNYK-JS-CONVERTSVGTOJPEG-2348245 - https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14
CVE ID: CVE-2021-23632 State: PUBLISHED Published: 2022-03-17T11:20:22.259001Z Last Updated: 2024-09-16T17:38:11.969Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: git Problem Types: Remote Code Execution (RCE) Description: All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require("git").Git; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { consol
; var repo = new Git("repo-test"); var user_input = "version; date"; repo.git(user_input, function(err, result) { console.log(result); }) 2. In the same directory as exploit.js, run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GIT-1568518
CVE ID: CVE-2021-23639 State: PUBLISHED Published: 2021-12-10T20:05:16.643350Z Last Updated: 2024-09-17T00:45:43.108Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: md-to-pdf Problem Types: Remote Code Execution (RCE) Description: The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 - https://github.com/simonhaenisch/md-to-pdf/issues/99 - https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82f
https://github.com/simonhaenisch/md-to-pdf/issues/99 - https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a
CVE ID: CVE-2021-23648 State: PUBLISHED Published: 2022-03-16T15:45:19.074838Z Last Updated: 2024-09-16T16:22:58.288Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: @braintree/sanitize-url Problem Types: Cross-site Scripting (XSS) Description: The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882 - https://github.com/braintree/sanitize-url/blob/main/src/index.ts%23L11 - https://github.com/braintree/sanitize-url/pull/40 - https
thub.com/braintree/sanitize-url/blob/main/src/index.ts%23L11 - https://github.com/braintree/sanitize-url/pull/40 - https://github.com/braintree/sanitize-url/pull/40/commits/e5afda45d9833682b705f73fc2c1265d34832183 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/
CVE ID: CVE-2021-23654 State: PUBLISHED Published: 2021-11-26T20:05:11.206936Z Last Updated: 2024-09-16T17:43:55.862Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: html-to-csv Problem Types: Improper Input Validation Description: This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-15
SV files. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-HTMLTOCSV-1582784 - https://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py
CVE ID: CVE-2021-23663 State: PUBLISHED Published: 2021-12-10T20:05:28.884792Z Last Updated: 2024-09-16T18:07:55.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P) Vendors: n/a Products: sey Problem Types: Prototype Pollution Description: All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SEY-1727592
CVE ID: CVE-2021-23664 State: PUBLISHED Published: 2022-01-21T20:00:14.556630Z Last Updated: 2024-09-16T23:41:58.075Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P) Vendors: n/a Products: @isomorphic-git/cors-proxy Problem Types: Server-side Request Forgery (SSRF) Description: The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 - https://github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7
uln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 - https://github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7cf0ac62b859e03311
CVE ID: CVE-2021-23673 State: PUBLISHED Published: 2021-11-22T17:00:22.592159Z Last Updated: 2024-09-17T00:05:50.281Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: pekeupload Problem Types: Cross-site Scripting (XSS) Description: This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PEKEUPLOAD-1584360 - https://github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue
thub.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226
CVE ID: CVE-2021-23682 State: PUBLISHED Published: 2022-02-16T17:05:26.116855Z Last Updated: 2024-09-16T20:17:30.120Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: litespeed.js, appwrite/server-ce Problem Types: Prototype Pollution Description: This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LI
ollution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250 - https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820 - https://github.com/litespeed-js/litespeed.js/pull/18 - https://github.com/appwrite/appwrite/releases/tag/0.12.2 - https://github.com/appwrite/appwrite/pull/2778 - https://github.com/appwrite/appwrite/releases/tag/0.11.1
CVE ID: CVE-2021-23700 State: PUBLISHED Published: 2021-12-10T20:05:22.255505Z Last Updated: 2024-09-16T21:09:04.413Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P) Vendors: n/a Products: merge-deep2 Problem Types: Prototype Pollution Description: All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MERGEDEEP2-1727593
CVE ID: CVE-2021-23702 State: PUBLISHED Published: 2022-02-18T20:00:13.292144Z Last Updated: 2024-09-17T03:37:50.558Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:P) Vendors: n/a Products: object-extend Problem Types: Prototype Pollution Description: The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-OBJECTEXTEND-2401470