Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28421 State: PUBLISHED Published: 2020-11-23T15:43:25 Last Updated: 2024-08-04T16:33:59.156Z Vendors: n/a Products: CA Unified Infrastructure Management Problem Types: Local Privilege Elevation Description: CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackers to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/security-advisories/CA20201116-01-Security-Notice-for-CA-Unified-Infrastructure-Management/16565 - http://seclists.org/fulldisclosure/2020/Nov/41
CVE ID: CVE-2020-28422 State: PUBLISHED Published: 2022-07-25T14:06:16.156895Z Last Updated: 2024-09-16T23:16:01.395Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L/RL:T) Vendors: n/a Products: git-archive Problem Types: Command Injection Description: All versions of package git-archive are vulnerable to Command Injection via the exports function. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-GITARCHIVE-1050391
CVE ID: CVE-2020-28423 State: PUBLISHED Published: 2022-08-02T13:28:02.942289Z Last Updated: 2024-09-16T16:13:18.587Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: monorepo-build Problem Types: Command Injection Description: This affects all versions of package monorepo-build. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MONOREPOBUILD-1050392
CVE ID: CVE-2020-28424 State: PUBLISHED Published: 2022-08-02T13:27:51.364793Z Last Updated: 2024-09-16T22:45:16.086Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: s3-kilatstorage Problem Types: Command Injection Description: This affects all versions of package s3-kilatstorage. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-S3KILATSTORAGE-1050396
CVE ID: CVE-2020-28425 State: PUBLISHED Published: 2022-08-02T13:27:33.975674Z Last Updated: 2024-09-16T17:09:02.779Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: curljs Problem Types: Command Injection Description: This affects all versions of package curljs. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-CURLJS-1050404
CVE ID: CVE-2020-28426 State: PUBLISHED Published: 2021-02-01T15:30:15.549171Z Last Updated: 2024-09-17T00:22:00.376Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: kill-process-on-port Problem Types: Command Injection Description: All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLPROCESSONPORT-1055458
CVE ID: CVE-2020-28429 State: PUBLISHED Published: 2021-02-23T15:10:14.491836Z Last Updated: 2024-09-16T20:42:16.025Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: geojson2kml Problem Types: Command Injection Description: All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){}) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412
CVE ID: CVE-2020-28430 State: REJECTED Published: 2021-02-23T15:20:21 Last Updated: 2021-08-12T14:35:50 Description: No description available.
CVE ID: CVE-2020-28431 State: REJECTED Published: 2021-02-23T15:20:11 Last Updated: 2021-03-22T19:42:28 Description: No description available.
CVE ID: CVE-2020-28432 State: REJECTED Published: 2021-02-23T15:30:15 Last Updated: 2021-03-22T19:44:21 Description: No description available.
CVE ID: CVE-2020-28433 State: PUBLISHED Published: 2022-08-02T13:27:18.522589Z Last Updated: 2024-09-16T16:32:31.196Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: node-latex-pdf Problem Types: Command Injection Description: This affects all versions of package node-latex-pdf. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NODELATEXPDF-1050426
CVE ID: CVE-2020-28434 State: PUBLISHED Published: 2022-08-02T13:26:12.228273Z Last Updated: 2024-09-16T23:56:36.159Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: gitblame Problem Types: Command Injection Description: This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-GITBLAME-1050430
CVE ID: CVE-2020-28435 State: PUBLISHED Published: 2022-07-25T14:10:26.870888Z Last Updated: 2024-09-16T19:41:43.285Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: ffmpeg-sdk Problem Types: Command Injection Description: This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-FFMPEGSDK-1050429
CVE ID: CVE-2020-28436 State: PUBLISHED Published: 2022-07-25T14:09:01.135512Z Last Updated: 2024-09-17T04:29:00.045Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: google-cloudstorage-commands Problem Types: Command Injection Description: This affects all versions of package google-cloudstorage-commands. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-GOOGLECLOUDSTORAGECOMMANDS-1050431 - https://github.com/samradical/google-cloudstorage-commands/blob/master/index.js%23L11
CVE ID: CVE-2020-28437 State: PUBLISHED Published: 2022-08-02T13:25:58.412011Z Last Updated: 2024-09-17T03:54:52.000Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: heroku-env Problem Types: Command Injection Description: This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-HEROKUENV-1050432
CVE ID: CVE-2020-28438 State: PUBLISHED Published: 2022-07-25T14:05:56.863325Z Last Updated: 2024-09-16T22:39:54.717Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: deferred-exec Problem Types: Command Injection Description: This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-DEFERREDEXEC-1050433
CVE ID: CVE-2020-28439 State: PUBLISHED Published: 2020-12-11T16:55:21.069537Z Last Updated: 2024-09-16T19:56:43.193Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: corenlp-js-prefab Problem Types: Command Injection Description: This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC: Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CORENLPJSPREFAB-1050434
CVE ID: CVE-2020-28440 State: PUBLISHED Published: 2020-12-11T16:55:17.072088Z Last Updated: 2024-09-16T22:08:23.124Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: corenlp-js-interface Problem Types: Command Injection Description: All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CORENLPJSINTERFACE-1050435
CVE ID: CVE-2020-28441 State: PUBLISHED Published: 2022-07-25T14:06:32.324953Z Last Updated: 2024-09-16T18:28:41.240Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: conf-cfg-ini Problem Types: Prototype Pollution Description: This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973 - https://github.com/loge5/conf-cfg-ini/commit/3a88
ferences: - https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973 - https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea
CVE ID: CVE-2020-28442 State: PUBLISHED Published: 2020-12-15T07:25:15.395923Z Last Updated: 2024-09-16T16:58:36.205Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: js-data Problem Types: Prototype Pollution Description: All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSDATA-1023655 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1050978 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050979 - https://github.com/js-data/js-data/blob/master/src/utils.js%23L417
CVE ID: CVE-2020-28443 State: PUBLISHED Published: 2022-07-25T14:05:10.581281Z Last Updated: 2024-09-17T02:36:17.990Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: sonar-wrapper Problem Types: Command Injection Description: This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-SONARWRAPPER-1050980
CVE ID: CVE-2020-28445 State: PUBLISHED Published: 2022-07-25T14:10:11.158478Z Last Updated: 2024-09-16T17:03:26.544Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: npm-help Problem Types: Command Injection Description: This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NPMHELP-1050983 - https://security.netapp.com/advisory/ntap-20220901-0012/
CVE ID: CVE-2020-28446 State: PUBLISHED Published: 2022-07-25T14:05:28.210925Z Last Updated: 2024-09-17T04:20:46.458Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: ntesseract Problem Types: Command Injection Description: The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NTESSERACT-1050982 - https://github.com/taoyuan/ntesseract/commit/fcbc36f381798b4362179c0cdf9961b437c7b619
CVE ID: CVE-2020-28447 State: PUBLISHED Published: 2022-07-25T14:11:23.108871Z Last Updated: 2024-09-17T00:20:49.743Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: xopen Problem Types: Command Injection Description: This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-XOPEN-1050981
CVE ID: CVE-2020-28448 State: PUBLISHED Published: 2020-12-22T13:05:19.967441Z Last Updated: 2024-09-16T19:36:53.039Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R) Vendors: n/a Products: multi-ini Problem Types: Prototype Pollution Description: This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MULTIINI-1048969 - https://github.com/evangelion1204/multi-ini/pull/37
CVE ID: CVE-2020-28449 State: PUBLISHED Published: 2021-02-04T14:40:22.464173Z Last Updated: 2024-09-16T22:20:18.104Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: decal Problem Types: Prototype Pollution Description: This affects all versions of package decal. The vulnerability is in the set function. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/decal - https://snyk.io/vuln/SNYK-JS-DECAL-1051007 - https://github.com/gigafied/decal.js/blob/master/src/utils/set.js%23L45-L73
CVE ID: CVE-2020-28450 State: PUBLISHED Published: 2021-02-04T14:40:16.022464Z Last Updated: 2024-09-17T01:56:19.016Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: n/a Products: decal Problem Types: Prototype Pollution Description: This affects all versions of package decal. The vulnerability is in the extend function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DECAL-1051028 - https://www.npmjs.com/package/decal - https://github.com/gigafied/decal.js/blob/master/src/utils/extend.js%23L23-L56
CVE ID: CVE-2020-28451 State: PUBLISHED Published: 2022-08-02T13:25:47.528340Z Last Updated: 2024-09-17T03:55:03.518Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: image-tiler Problem Types: Command Injection Description: This affects the package image-tiler before 2.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-IMAGETILER-1051029 - https://github.com/MrP/image-tiler/commit/f4a0b13a4bf43655fc4013e04bbceaf77aecbeb8
CVE ID: CVE-2020-28452 State: PUBLISHED Published: 2021-01-20T17:46:54.969980Z Last Updated: 2024-09-16T23:26:11.130Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: com.softwaremill.akka-http-session:core_2.12, com.softwaremill.akka-http-session:core_2.11, com.softwaremill.akka-http-session:core_2.13 Problem Types: Cross-site Request Forgery (CSRF) Description: This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forgi
e package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/softwaremill/akka-http-session/issues/77 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046674 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046675 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1058933 - https://github.com/softwaremil
SESSION-1046675 - https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1058933 - https://github.com/softwaremill/akka-http-session/pull/79
CVE ID: CVE-2020-28453 State: PUBLISHED Published: 2022-08-02T13:25:31.635589Z Last Updated: 2024-09-16T19:46:44.436Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: npos-tesseract Problem Types: Command Injection Description: This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NPOSTESSERACT-1051031
CVE ID: CVE-2020-28455 State: PUBLISHED Published: 2022-07-25T14:10:37.856323Z Last Updated: 2024-09-16T23:01:17.912Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: markdown-it-toc Problem Types: Cross-site Scripting (XSS) Description: This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067
CVE ID: CVE-2020-28456 State: PUBLISHED Published: 2020-12-15T15:35:21.935881Z Last Updated: 2024-09-16T17:33:09.538Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: s-cart/core Problem Types: Cross-site Scripting (XSS) Description: The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/s-cart/s-cart/releases/tag/v4.4 - https://snyk.io/vuln/SNYK-PHP-SCARTCORE-1047609 - https://github.com/s-cart/s-cart/issues/52 - https://github.com/s-cart/core/commit/f4b2811293063a3a2bb497b2512d8a18bd202219
CVE ID: CVE-2020-28457 State: PUBLISHED Published: 2020-12-15T15:35:14.870453Z Last Updated: 2024-09-16T20:22:37.194Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: s-cart/core Problem Types: Cross-site Scripting (XSS) Description: This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-SCARTCORE-1047342 - https://github.com/s-cart/s-cart/issues/51 - https://github.com/s-cart/s-cart/releases/tag/v4.4 - https://github.com/s-cart
ps://github.com/s-cart/s-cart/issues/51 - https://github.com/s-cart/s-cart/releases/tag/v4.4 - https://github.com/s-cart/s-cart/commit/4406d407ad363ee7e4795ee290c9d2430b0413f8
CVE ID: CVE-2020-28458 State: PUBLISHED Published: 2020-12-16T10:35:20.456264Z Last Updated: 2024-09-16T23:22:14.200Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: datatables.net Problem Types: Prototype Pollution Description: All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962 - https://github.com/DataTables/Dist-Dat
-ORGWEBJARSBOWER-1051961 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962 - https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766 - https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03 - https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2020-28459 State: PUBLISHED Published: 2022-07-25T14:05:43.371420Z Last Updated: 2024-09-16T20:27:19.935Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: markdown-it-decorate Problem Types: Cross-site Scripting (XSS) Description: This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITDECORATE-1044068
CVE ID: CVE-2020-28460 State: PUBLISHED Published: 2020-12-22T13:05:14.404340Z Last Updated: 2024-09-17T02:56:56.365Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R) Vendors: n/a Products: multi-ini Problem Types: Prototype Pollution Description: This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MULTIINI-1053229 - https://github.com/evangelion1204/multi-ini/commit/6b2212b2ce152c19538a2431415f72942c5a1bde
CVE ID: CVE-2020-28461 State: PUBLISHED Published: 2022-07-25T14:06:46.888643Z Last Updated: 2024-09-16T18:39:03.916Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: js-ini Problem Types: Prototype Pollution Description: This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970 - https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d
https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970 - https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d4c231784931e
CVE ID: CVE-2020-28462 State: PUBLISHED Published: 2022-07-25T14:07:05.276313Z Last Updated: 2024-09-16T16:44:05.253Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: ion-parser Problem Types: Prototype Pollution Description: This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-IONPARSER-1048971
CVE ID: CVE-2020-28463 State: PUBLISHED Published: 2021-02-18T16:00:21.220773Z Last Updated: 2024-09-17T01:27:03.761Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: reportlab Problem Types: Server-side Request Forgery (SSRF) Description: All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="ht
Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145 - https://www.reportlab.com/docs/reportlab-userguide.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ
guide.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html