Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703 - https://github.com/chasyumen/lite-web-server/blob/main/src/WebServer.js%23L274 - https://gist.github.com/lirantal/637520812da06fffb91dd86d02ff6bde
CVE ID: CVE-2023-26105 State: PUBLISHED Published: 2023-02-28T05:00:01.938Z Last Updated: 2025-03-11T14:13:06.468Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: utilities Problem Types: CWE-1321 Description: All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-UTILITIES-3184491 - https://github.com/mde/utilities/issues/29
CVE ID: CVE-2023-26106 State: PUBLISHED Published: 2023-03-06T05:00:01.143Z Last Updated: 2025-03-05T20:31:58.446Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: dot-lens Problem Types: CWE-1321 Description: All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-DOTLENS-3227646 - https://github.com/jb55/dot-lens/blob/465ef2088e4065b7be1c4372eedd2215c3820bc4/index.js%23L70
CVE ID: CVE-2023-26107 State: PUBLISHED Published: 2023-03-06T05:00:04.316Z Last Updated: 2025-03-05T19:51:11.794Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P) Vendors: n/a Products: sketchsvg Problem Types: CWE-94 Description: All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b
curity.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 - https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 - https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64
CVE ID: CVE-2023-26108 State: PUBLISHED Published: 2023-03-06T05:00:05.073Z Last Updated: 2025-03-05T19:48:14.569Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: @nestjs/core Problem Types: CWE-200 Description: Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127 -
VE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127 - https://github.com/nestjs/nest/issues/9759 - https://github.com/nestjs/nest/pull/9819 - https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41
CVE ID: CVE-2023-26109 State: PUBLISHED Published: 2023-03-09T05:00:03.349Z Last Updated: 2025-02-28T21:36:11.924Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: node-bluetooth-serial-port Problem Types: CWE-120 Description: All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NODEBLUETOOTHSERIALPORT-3311820
CVE ID: CVE-2023-26110 State: PUBLISHED Published: 2023-03-09T05:00:02.220Z Last Updated: 2025-02-28T21:35:08.963Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: node-bluetooth Problem Types: CWE-120 Description: All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NODEBLUETOOTH-3311821
CVE ID: CVE-2023-26111 State: PUBLISHED Published: 2023-03-06T05:00:03.346Z Last Updated: 2025-03-05T20:30:05.472Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: @nubosoftware/node-static, node-static Problem Types: CWE-22 Description: All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927 - https://security.snyk.io/v
ichment: References: - https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927 - https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928 - https://gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc - https://github.com/cloudhead/node-static/blob/master/lib/node-static.js%23L160-L163
CVE ID: CVE-2023-26112 State: PUBLISHED Published: 2023-04-03T05:00:01.443Z Last Updated: 2025-02-13T19:35:38.781Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: configobj Problem Types: CWE-1333 Description: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 - https://gith
ainer: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 - https://github.com/DiffSK/configobj/issues/232 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/
CVE ID: CVE-2023-26113 State: PUBLISHED Published: 2023-03-18T05:00:01.243Z Last Updated: 2025-02-26T17:12:06.093Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: collection.js Problem Types: CWE-1321 Description: Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 - https://github.com/kobezzza/Collection/issues/27 - https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1a
s://github.com/kobezzza/Collection/issues/27 - https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 - https://github.com/kobezzza/Collection/releases/tag/v6.8.1 - https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2
CVE ID: CVE-2023-26114 State: PUBLISHED Published: 2023-03-23T05:00:01.220Z Last Updated: 2025-02-25T19:30:08.466Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P) Vendors: n/a Products: code-server Problem Types: CWE-1385 Description: Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - https://github.com/coder/code-ser
Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 - https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 - https://github.com/coder/code-server/releases/tag/v4.10.1
CVE ID: CVE-2023-26115 State: PUBLISHED Published: 2023-06-22T05:00:01.472Z Last Updated: 2025-02-13T16:44:48.145Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: word-wrap, org.webjars.npm:word-wrap Problem Types: CWE-1333 Description: All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657 - https://github.com/j
.io/vuln/SNYK-JS-WORDWRAP-3149973 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657 - https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39 - https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-26116 State: PUBLISHED Published: 2023-03-30T05:00:03.402Z Last Updated: 2025-11-03T19:28:05.754Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: angular, org.webjars.bower:angular, org.webjars.npm:angular, org.webjars.bowergithub.angular:angular Problem Types: CWE-1333 Description: Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. Additional Analyst Note
y is possible by a large carefully-crafted input, which can result in catastrophic backtracking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406320 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406321 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406322 - https://stackblitz.com/edit/angularjs-vulnerability-angular-copy-redos - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://lists.fedoraproject.org/archives/lis
nnounce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
CVE ID: CVE-2023-26117 State: PUBLISHED Published: 2023-03-30T05:00:01.348Z Last Updated: 2025-11-03T19:28:07.269Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: angular, org.webjars.bower:angular, org.webjars.npm:angular, org.webjars.bowergithub.angular:angular Problem Types: CWE-1333 Description: Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. Additional Analyst Notes: - CVE Progra
y a large carefully-crafted input, which can result in catastrophic backtracking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325 - https://stackblitz.com/edit/angularjs-vulnerability-resource-trailing-slashes-redos - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://lists.fedoraproject.org/archives/list/
ounce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
CVE ID: CVE-2023-26118 State: PUBLISHED Published: 2023-03-30T05:00:02.352Z Last Updated: 2025-11-03T19:28:08.698Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: angular, org.webjars.bower:angular, org.webjars.npm:angular, org.webjars.bowergithub.angular:angular Problem Types: CWE-1333 Description: Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtrackin
ploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406326 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406327 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406328 - https://stackblitz.com/edit/angularjs-vulnerability-inpur-url-validation-redos - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://li
roject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
CVE ID: CVE-2023-26119 State: PUBLISHED Published: 2023-04-03T05:00:02.503Z Last Updated: 2024-08-02T11:39:06.613Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: net.sourceforge.htmlunit:htmlunit Problem Types: CWE-94 Description: Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500 - https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b - https://siebe
EHTMLUNIT-3252500 - https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b - https://siebene.github.io/2022/12/30/HtmlUnit-RCE/
CVE ID: CVE-2023-26120 State: PUBLISHED Published: 2023-04-10T05:00:01.218Z Last Updated: 2025-02-07T20:10:54.134Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: com.xuxueli:xxl-job Problem Types: CWE-79 Description: This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMXUXUELI-3248764
CVE ID: CVE-2023-26121 State: PUBLISHED Published: 2023-04-11T05:00:01.308Z Last Updated: 2025-02-10T15:16:54.743Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: safe-eval Problem Types: CWE-1321 Description: All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062 - https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9 - https://github.com/hacksparrow/safe-eval/issues/28
CVE ID: CVE-2023-26122 State: PUBLISHED Published: 2023-04-11T05:00:02.658Z Last Updated: 2025-02-07T16:56:45.658Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: safe-eval Problem Types: CWE-265 Description: All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulnerable functions:** __defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(), valueOf(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
, propertyIsEnumerable.call(), valueOf(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064 - https://github.com/hacksparrow/safe-eval/issues/27 - https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce - https://github.com/hacksparrow/safe-eval/issues/31 - https://github.com/hacksparrow/safe-eval/issues/32 - https://github.com/hacksparrow/safe-eval/issues/33 - https://github.com/hacksparrow/safe-eval/issues/34 - https://github.com/hacksparrow/safe-eval/issues/35
CVE ID: CVE-2023-26123 State: PUBLISHED Published: 2023-04-14T05:00:01.188Z Last Updated: 2025-02-06T20:42:47.318Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: raysan5/raylib Problem Types: CWE-79 Description: Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function. **Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platfor
This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188 - https://github.com/raysan5/raylib/issues/2954 - https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d - https://github.com/raysan5/raylib/releases/tag/4.5.0
CVE ID: CVE-2023-26125 State: PUBLISHED Published: 2023-05-04T05:00:01.441Z Last Updated: 2025-01-29T16:57:46.620Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: github.com/gin-gonic/gin Problem Types: CWE-20 Description: Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may de
ts own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285 - https://github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b - https://github.com/gin-gonic/gin/pull/3500 - https://github.com/gin-gonic/gin/pull/3503 - https://github.com/gin-gonic/gin/releases/tag/v1.9.0
CVE ID: CVE-2023-26126 State: PUBLISHED Published: 2023-05-10T05:00:01.474Z Last Updated: 2025-01-27T18:38:31.700Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: m.static Problem Types: CWE-22 Description: All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915 - https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
CVE ID: CVE-2023-26127 State: PUBLISHED Published: 2023-05-27T05:00:03.774Z Last Updated: 2025-01-13T21:22:53.125Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: n158 Problem Types: CWE-78 Description: All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment. Additional Analyst Notes: - CVE
uires some level of access to the system or application hosting the Node.js environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-N158-3183746 - https://github.com/dsilva2401/n158/blob/master/src/cli/initProject.js%23L8
CVE ID: CVE-2023-26128 State: PUBLISHED Published: 2023-05-27T05:00:02.782Z Last Updated: 2025-01-13T21:22:26.003Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: keep-module-latest Problem Types: CWE-78 Description: All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or applica
to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-KEEPMODULELATEST-3157165 - https://github.com/liujunyang/keep-module-latest/blob/master/index.js%23L50
CVE ID: CVE-2023-26129 State: PUBLISHED Published: 2023-05-27T05:00:01.547Z Last Updated: 2025-01-13T21:08:09.689Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: bwm-ng Problem Types: CWE-78 Description: All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. **Note:** To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment. Additional Ana
his typically requires some level of access to the system or application hosting the Node.js environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-BWMNG-3175876