Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
easenotes/8.3.2.html - https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/ - https://security.gentoo.org/glsa/202211-10 - https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
CVE ID: CVE-2021-23438 State: PUBLISHED Published: 2021-09-01T18:20:11.072688Z Last Updated: 2024-09-16T17:52:46.870Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: mpath Problem Types: Prototype Pollution Description: This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the
ay is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MPATH-1577289 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548 - https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc
CVE ID: CVE-2021-23439 State: PUBLISHED Published: 2021-09-05T14:10:11.175401Z Last Updated: 2024-09-16T18:56:03.367Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: file-upload-with-preview Problem Types: Cross-site Scripting (XSS) Description: This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FILEUPLOADWITHPREVIEW-1579492 - https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-up
K-JS-FILEUPLOADWITHPREVIEW-1579492 - https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-upload-with-preview.js%23L168 - https://github.com/johndatserakis/file-upload-with-preview/pull/40/files?file-filters%5B%5D=.js&hide-deleted-files=true%23diff-fe47b243de17419c0daa22cd785cd754baed60cf3679d3da1d6fe006f9f4a7f0R174
CVE ID: CVE-2021-23440 State: PUBLISHED Published: 2021-09-12T12:55:10.983786Z Last Updated: 2024-09-16T19:20:29.828Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: set-value Problem Types: Prototype Pollution Description: This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212 - https://github.com/jonschlinkert/set-value/commit/7cf8073bb
541 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212 - https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452 - https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/ - https://github.com/jonschlinkert/set-value/pull/33 - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2021-23441 State: REJECTED Published: 2021-09-19T13:40:10 Last Updated: 2021-10-22T13:36:31 Description: No description available.
CVE ID: CVE-2021-23442 State: PUBLISHED Published: 2021-09-17T09:45:13.166544Z Last Updated: 2024-09-16T22:15:53.817Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:R) Vendors: n/a Products: @cookiex/deep Problem Types: Prototype Pollution Description: This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-COOKIEXDEEP-1582793 - https://github.com/tony-tsx/cookiex-deep/issues/1 - https://github.com/tony-tsx/cookiex-deep/commit/b5bea2b7f34a5fa9abb4446cbd038ecdbcd09c88
CVE ID: CVE-2021-23443 State: PUBLISHED Published: 2021-09-21T16:50:10.641657Z Last Updated: 2024-09-16T22:09:33.398Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: edge.js Problem Types: Cross-site Scripting (XSS) Description: This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556 - https://github.com/edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21
CVE ID: CVE-2021-23444 State: PUBLISHED Published: 2021-09-21T16:55:26.156234Z Last Updated: 2024-09-16T20:58:36.745Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: jointjs Problem Types: Prototype Pollution Description: This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJA
SNYK-JS-JOINTJS-1579578 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817 - https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8 - https://github.com/clientIO/joint/releases/tag/v3.4.2 - https://github.com/clientIO/joint/pull/1514
CVE ID: CVE-2021-23445 State: PUBLISHED Published: 2021-09-27T16:35:18.234764Z Last Updated: 2024-09-16T18:39:20.468Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: datatables.net Problem Types: Cross-site Scripting (XSS) Description: This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376 - https:
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376 - https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b - https://cdn.datatables.net/1.11.3/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00018.html - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-23446 State: PUBLISHED Published: 2021-09-29T16:45:28.726765Z Last Updated: 2024-09-16T19:31:26.679Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: handsontable, Handsontable Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HANDSONTABLE-1726770 - https://snyk.io/vuln/SNYK-DOTNET-HANDSONTABLE-1726793 - https://snyk.io/vul
/snyk.io/vuln/SNYK-JS-HANDSONTABLE-1726770 - https://snyk.io/vuln/SNYK-DOTNET-HANDSONTABLE-1726793 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBHANDSONTABLE-1726794 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1726795 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1726796 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1726797 - https://github.com/handsontable/handsontable/issues/8752 - https://github.com/handsontable/handsontable/pull/8742
CVE ID: CVE-2021-23447 State: PUBLISHED Published: 2021-10-07T16:40:12.628956Z Last Updated: 2024-09-16T22:20:45.340Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: teddy Problem Types: Cross-site Scripting (XSS) Description: This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TEDDY-1579557 - https://github.com/rooseveltframework/teddy/pull/518 - https://github.com/rooseveltframework/teddy/releases/tag/0.5.9
CVE ID: CVE-2021-23448 State: PUBLISHED Published: 2021-10-11T20:15:12.313617Z Last Updated: 2024-09-16T16:27:48.177Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: config-handler Problem Types: Prototype Pollution Description: All versions of package config-handler are vulnerable to Prototype Pollution when loading config files. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONFIGHANDLER-1564947 - https://github.com/jarradseers/config-handler/issues/1
CVE ID: CVE-2021-23449 State: PUBLISHED Published: 2021-10-18T16:40:13.749256Z Last Updated: 2024-09-17T01:46:09.662Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: vm2 Problem Types: Sandbox Bypass Description: This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-VM2-1585918 - https://github.com/patriksimek/vm2/issues/363 - https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886 - https://github.com/patriksimek/vm2/release
/github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886 - https://github.com/patriksimek/vm2/releases/tag/3.9.4 - https://security.netapp.com/advisory/ntap-20211029-0010/
CVE ID: CVE-2021-23450 State: PUBLISHED Published: 2021-12-17T20:05:19.155728Z Last Updated: 2024-09-16T20:53:01.107Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: dojo Problem Types: Prototype Pollution Description: All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DOJO-1535223 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-231303
DOJO-2313034 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036 - https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html
CVE ID: CVE-2021-23451 State: PUBLISHED Published: 2022-07-25T14:11:12.623106Z Last Updated: 2024-09-17T03:23:49.759Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: otp-generator Problem Types: Insecure Randomness Description: The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-OTPGENERATOR-1655480 - https://github.com/Maheshkumar-Kakade/otp-generator/issues/12 - https://github.com/Maheshkumar-Kakade/otp-generator/commit/b27
//github.com/Maheshkumar-Kakade/otp-generator/issues/12 - https://github.com/Maheshkumar-Kakade/otp-generator/commit/b27de1ce439ae7f533cec26677e9698671275b70
CVE ID: CVE-2021-23452 State: PUBLISHED Published: 2021-10-20T12:15:12.893325Z Last Updated: 2024-09-16T23:06:33.921Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P) Vendors: n/a Products: x-assign Problem Types: Prototype Pollution Description: This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-XASSIGN-1759314 - https://runkit.com/embed/sq8qjwemyn8t
CVE ID: CVE-2021-23460 State: PUBLISHED Published: 2022-01-21T20:05:13.230568Z Last Updated: 2024-09-16T17:15:12.528Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: min-dash Problem Types: Prototype Pollution Description: The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MINDASH-2340605 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127 - https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32 - https://github.com/bpmn-
github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32 - https://github.com/bpmn-io/min-dash/pull/21 - https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320
CVE ID: CVE-2021-23463 State: PUBLISHED Published: 2021-12-10T20:00:14.594368Z Last Updated: 2024-09-17T03:47:43.105Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:P) Vendors: n/a Products: com.h2database:h2 Problem Types: XML External Entity (XXE) Injection Description: The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability. Additional Analyst Notes: - CVE Program Con
hod when the parameter is DOMSource.class it will trigger the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/h2database/h2database/issues/3195 - https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238 - https://github.com/h2database/h2database/pull/3199 - https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20230818-0010/
CVE ID: CVE-2021-23470 State: PUBLISHED Published: 2022-02-04T20:05:12.083691Z Last Updated: 2024-09-16T23:32:07.792Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P) Vendors: n/a Products: putil-merge Problem Types: Prototype Pollution Description: This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vu
k.io/vuln/SNYK-JS-PUTILMERGE-1317077 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487 - https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5
CVE ID: CVE-2021-23472 State: PUBLISHED Published: 2021-11-03T17:25:11.866417Z Last Updated: 2024-09-17T02:56:45.202Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: n/a Products: bootstrap-table Problem Types: Cross-site Scripting (XSS) Description: This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJA
m Container: References: - https://snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBWENZHIXIN-1910687 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910688 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1910689 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1910690 - https://github.com/wenzhixin/bootstrap-table/blob/develop/src/utils/index.js%23L218 - https://security.snyk.io/vuln/SNYK-JS-BOOTSTRAPTABLE-1657597
CVE ID: CVE-2021-23484 State: PUBLISHED Published: 2022-01-28T21:31:29.458096Z Last Updated: 2024-09-16T21:56:44.351Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477 - https://github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365 - https://github.com/Mostafa-Samir/zip-local/commit/949446a95a66
.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365 - https://github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085
CVE ID: CVE-2021-23490 State: PUBLISHED Published: 2021-12-24T20:05:16.292724Z Last Updated: 2024-09-16T22:03:26.999Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: parse-link-header Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PARSELINKHEADER-1582783 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2321973 - https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed888
SNYK-JAVA-ORGWEBJARSNPM-2321973 - https://github.com/thlorenz/parse-link-header/commit/72f05c717b3f129c5331a07bf300ed8886eb8ae1
CVE ID: CVE-2021-23495 State: PUBLISHED Published: 2022-02-25T20:00:16.188280Z Last Updated: 2024-09-16T23:01:46.904Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: karma Problem Types: Open Redirect Description: The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KARMA-2396325 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347 - https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
CVE ID: CVE-2021-23497 State: PUBLISHED Published: 2022-02-04T20:00:14.625111Z Last Updated: 2024-09-16T19:00:53.289Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: @strikeentco/set Problem Types: Prototype Pollution Description: This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/
VE Program Container: References: - https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/ - https://snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-2385945 - https://github.com/strikeentco/set/commit/b2f942c
CVE ID: CVE-2021-23507 State: PUBLISHED Published: 2022-02-04T20:05:18.907962Z Last Updated: 2024-09-17T03:54:51.495Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: object-path-set Problem Types: Prototype Pollution Description: The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908 Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input
st Notes: - CVE Program Container: References: - https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/ - https://snyk.io/vuln/SNYK-JS-OBJECTPATHSET-2388576 - https://github.com/skratchdot/object-path-set/blob/577f5299fed15bb9edd11c940ff3cf0b9f4748d5/index.js%23L8 - https://github.com/skratchdot/object-path-set/commit/2d67a714159c4099589b6661fa84e6d2adc31761
CVE ID: CVE-2021-23509 State: PUBLISHED Published: 2021-11-03T17:20:36.571477Z Last Updated: 2024-09-16T20:32:29.801Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: json-ptr Problem Types: Prototype Pollution Description: This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSONPTR-1577291 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1767165 - https://github.com/flitbit/json-ptr/pull/42 - https://github.
1 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1767165 - https://github.com/flitbit/json-ptr/pull/42 - https://github.com/flitbit/json-ptr/commit/5dc458fbad1c382a2e3ca6d62e66ede3d92849ca - https://github.com/flitbit/json-ptr%23security-vulnerabilities-resolved
CVE ID: CVE-2021-23514 State: PUBLISHED Published: 2022-01-13T14:10:13.102808Z Last Updated: 2024-09-16T19:10:37.111Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: Crow Problem Types: Path Traversal Description: This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336163 - https://github.com/CrowCpp/Crow/pull/317 - https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4
CVE ID: CVE-2021-23518 State: PUBLISHED Published: 2022-01-21T20:05:29.374465Z Last Updated: 2024-09-16T18:33:30.300Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: cached-path-relative Problem Types: Prototype Pollution Description: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:*