Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-23352 State: PUBLISHED Published: 2021-03-09T18:30:23.064433Z Last Updated: 2024-09-16T23:11:05.188Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C) Vendors: n/a Products: madge Problem Types: Command Injection Description: This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MADGE-1082875 - https://github.com/pahen/madge/blob/master/lib/graph.js%23L27 - https
es: - https://snyk.io/vuln/SNYK-JS-MADGE-1082875 - https://github.com/pahen/madge/blob/master/lib/graph.js%23L27 - https://github.com/pahen/madge/commit/da5cbc9ab30372d687fa7c324b22af7ffa5c6332
CVE ID: CVE-2021-23353 State: PUBLISHED Published: 2021-03-09T18:30:18.066187Z Last Updated: 2024-09-17T01:27:08.086Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R) Vendors: n/a Products: jspdf Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSPDF-1073626 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1083286 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1083287 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288 - https://snyk.
ln/SNYK-JAVA-ORGWEBJARSBOWER-1083287 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-1083288 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1083289 - https://github.com/MrRio/jsPDF/commit/d8bb3b39efcd129994f7a3b01b632164144ec43e - https://github.com/MrRio/jsPDF/pull/3091
CVE ID: CVE-2021-23354 State: PUBLISHED Published: 2021-03-12T15:10:16.014140Z Last Updated: 2024-09-17T03:32:43.212Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: printf Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PRINTF-
e time complexity. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PRINTF-1072096 - https://github.com/adaltas/node-printf/pull/32 - https://github.com/adaltas/node-printf/issues/31
CVE ID: CVE-2021-23355 State: PUBLISHED Published: 2021-03-15T16:40:22.069889Z Last Updated: 2024-09-16T17:54:07.343Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: ps-kill Problem Types: Arbitrary Command Injection Description: This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){}); Additional Analyst Notes: - CVE
orter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){}); Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PSKILL-1078529
CVE ID: CVE-2021-23356 State: PUBLISHED Published: 2021-03-15T16:40:18.271256Z Last Updated: 2024-09-16T19:04:52.266Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: kill-process-by-name Problem Types: Arbitrary Command Injection Description: This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLPROCESSBYNAME-1078534
CVE ID: CVE-2021-23357 State: PUBLISHED Published: 2021-03-15T16:45:19.722989Z Last Updated: 2024-09-17T00:36:54.860Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: github.com/TykTechnologies/tyk/gateway Problem Types: Directory Traversal Description: All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be dele
r and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKGATEWAY-1078516 - https://github.com/TykTechnologies/tyk/issues/3390
CVE ID: CVE-2021-23358 State: PUBLISHED Published: 2021-03-29T13:15:34.770Z Last Updated: 2025-11-03T21:44:35.654Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: n/a Products: underscore Problem Types: Arbitrary Code Injection Description: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984 - https://snyk.io/vuln/SNYK-JAVA
- CISA ADP Vulnrichment: References: - https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505 - https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71 - https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html - https://www.debian.org/security/2021/dsa-4883 - https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cordova.apache.org%3E - https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%
rdova.apache.org%3E - https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cordova.apache.org%3E - https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba%40%3Cissues.cordova.apache.org%3E - https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039%40%3Cissues.cordova.apache.org%3E - https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cordova.apache.org%3E - https://www.tenable.com/security/tns-2021-14 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD
ns-2021-14 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGEE7U4Z655A2MK5EW4UQQZ7B64XJWBV/
CVE ID: CVE-2021-23359 State: PUBLISHED Published: 2021-03-18T12:40:15.690408Z Last Updated: 2024-09-17T03:18:03.737Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: port-killer Problem Types: Arbitrary Command Injection Description: This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success. Additional Analyst Notes: - CVE Program Container: Refer
be executed, leading to the creation of a file called success. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PORTKILLER-1078533 - https://github.com/tylerjpeterson/port-killer/blob/1ca3a99ad80cc9ed5498d12b185189c10329025b/index.js%23L19
CVE ID: CVE-2021-23360 State: PUBLISHED Published: 2021-03-21T15:45:15.917573Z Last Updated: 2024-09-17T02:41:42.500Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: killport Problem Types: Arbitrary Command Injection Description: This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success. Additional Analyst Notes: - CVE Program Container: References
xecuted, leading to the creation of a file called success. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLPORT-1078535 - https://github.com/ssnau/killport/blob/5268f23ea8f152e47182b263d8f7ef20c12a9f28/index.js%23L9 - https://github.com/ssnau/killport/commit/bec8e371f170a12e11cd222ffc7a6e1ae9942638
CVE ID: CVE-2021-23361 State: REJECTED Published: 2021-03-23T10:15:15 Last Updated: 2021-03-23T19:05:09 Description: No description available.
CVE ID: CVE-2021-23362 State: PUBLISHED Published: 2021-03-23T16:20:14.854942Z Last Updated: 2024-09-17T03:02:03.337Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: hosted-git-info Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 - https:/
ional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356 - https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3 - https://github.com/npm/hosted-git-info/commits/v2 - https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7 - https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01 - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-23363 State: PUBLISHED Published: 2021-03-30T15:00:15.284625Z Last Updated: 2024-09-17T01:56:52.764Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: kill-by-port Problem Types: Arbitrary Command Injection Description: This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLBYPORT-1078531 - https://github.com/GuyMograbi
: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-KILLBYPORT-1078531 - https://github.com/GuyMograbi/kill-by-port/blob/16dcbe264b6b4a5ecf409661b42836dd286fd43f/index.js%23L8 - https://github.com/GuyMograbi/kill-by-port/commit/ea5b1f377e196a4492e05ff070eba8b30b7372c4
CVE ID: CVE-2021-23364 State: PUBLISHED Published: 2021-04-28T15:35:19.189520Z Last Updated: 2024-09-17T00:06:27.590Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: browserslist Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182 - https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d2
/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182 - https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474 - https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98 - https://github.com/browserslist/browserslist/pull/593
CVE ID: CVE-2021-23365 State: PUBLISHED Published: 2021-04-26T10:05:33.138599Z Last Updated: 2024-09-17T00:56:27.158Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: github.com/TykTechnologies/tyk-identity-broker Problem Types: Authentication Bypass Description: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GI
decoding XML data). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720 - https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1 - https://github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0 - https://github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0 - https://github.com/TykTechnologies/tyk-identity-broker/pull/147
CVE ID: CVE-2021-23368 State: PUBLISHED Published: 2021-04-12T13:50:14.764222Z Last Updated: 2024-09-16T17:27:47.659Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: postcss Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244795 - https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5 - https://github
WEBJARSNPM-1244795 - https://github.com/postcss/postcss/commit/b6f3e4d5a8d7504d553267f80384373af3a3dec5 - https://github.com/postcss/postcss/commit/8682b1e4e328432ba692bed52326e84439cec9e4 - https://lists.apache.org/thread.html/r16e295b4f02d81b79981237d602cb0b9e59709bafaa73ac98be7cef1%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r8def971a66cf3e375178fbee752e1b04a812a047cc478ad292007e33%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r00158f5d770d75d0655c5eef1bdbc6150531606c8f8bcb778f0627be%40%3Cdev.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apache.or
://lists.apache.org/thread.html/r5acd89f3827ad9a9cad6d24ed93e377f7114867cd98cfba616c6e013%40%3Ccommits.myfaces.apache.org%3E - https://lists.apache.org/thread.html/rad5af2044afb51668b1008b389ac815a28ecea9eb75ae2cab5a00ebb%40%3Ccommits.myfaces.apache.org%3E - https://lists.apache.org/thread.html/r49afb49b38748897211b1f89c3a64dc27f9049474322b05715695aab%40%3Cdev.myfaces.apache.org%3E
CVE ID: CVE-2021-23369 State: PUBLISHED Published: 2021-04-12T13:10:28.403732Z Last Updated: 2024-09-16T22:46:07.677Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: handlebars Problem Types: Remote Code Execution (RCE) Description: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 - http
6767 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 - https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8 - https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 - https://security.netapp.com/advisory/ntap-20210604-0008/
CVE ID: CVE-2021-23370 State: PUBLISHED Published: 2021-04-12T13:10:33.961625Z Last Updated: 2024-09-17T03:14:08.004Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: swiper Problem Types: Prototype Pollution Description: This affects the package swiper before 6.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SWIPER-1088062 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244696 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBNOLIMITS4WEB-1244697 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1244698 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1244699 - https://github.com/nolimits4web/s
NYK-JAVA-ORGWEBJARS-1244698 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1244699 - https://github.com/nolimits4web/swiper/commit/9dad2739b7474f383474773d5ab898a0c29ac178
CVE ID: CVE-2021-23371 State: PUBLISHED Published: 2021-04-12T13:10:15.866105Z Last Updated: 2024-09-16T16:48:45.091Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: chrono-node Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CHRONONODE-1083228 - https://github.com/wanasit/chrono/issues/382 - https://github.com/wanasit/chrono/commit/98815b57622443b5c498a427210ebd603d705f4c
CVE ID: CVE-2021-23372 State: PUBLISHED Published: 2021-04-13T15:20:12.814651Z Last Updated: 2024-09-16T19:09:17.538Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: mongo-express Problem Types: Denial of Service (DoS) Description: All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-1085403
CVE ID: CVE-2021-23373 State: PUBLISHED Published: 2022-07-25T14:10:53.369798Z Last Updated: 2024-09-16T22:31:17.599Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: set-deep-prop Problem Types: Prototype Pollution Description: All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-SETDEEPPROP-1083231
CVE ID: CVE-2021-23374 State: PUBLISHED Published: 2021-04-18T18:40:37.318922Z Last Updated: 2024-09-16T17:04:05.835Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: ps-visitor Problem Types: Arbitrary Command Injection Description: This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PSVISITOR-1078544 - https://github.com/WisdomKwan/ps-visitor/blob
Container: References: - https://snyk.io/vuln/SNYK-JS-PSVISITOR-1078544 - https://github.com/WisdomKwan/ps-visitor/blob/cdfc934a8e4af95aa0473f4b2a4bd091d09faf2f/index.js%23L404
CVE ID: CVE-2021-23375 State: PUBLISHED Published: 2021-04-18T18:40:32.648229Z Last Updated: 2024-09-17T00:46:22.082Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: psnode Problem Types: Arbitrary Command Injection Description: This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PSNODE-1078543 - https://github.com/nrako/psnode/blob/076f623689e4506d364
er: References: - https://snyk.io/vuln/SNYK-JS-PSNODE-1078543 - https://github.com/nrako/psnode/blob/076f623689e4506d3647505daca13b3f482e0c31/lib/index.js%23L59
CVE ID: CVE-2021-23376 State: PUBLISHED Published: 2021-04-18T18:40:26.230826Z Last Updated: 2024-09-17T02:42:39.126Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: ffmpegdotjs Problem Types: Arbitrary Command Injection Description: This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FFMPEGDOTJS-1078542 - https://github.com/TRomesh/ffmpe
CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FFMPEGDOTJS-1078542 - https://github.com/TRomesh/ffmpegdotjs/blob/b7395daf0bdcb81218340427eb7073cdd28462af/index.js%23L219
CVE ID: CVE-2021-23377 State: PUBLISHED Published: 2021-04-18T18:40:20.548028Z Last Updated: 2024-09-17T04:29:33.274Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: onion-oled-js Problem Types: Arbitrary Command Injection Description: This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ONIONOLEDJS-1078808 - https://github.com/naddeoa/onio
CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ONIONOLEDJS-1078808 - https://github.com/naddeoa/onion-oled-js/blob/8a523645d2cc29130f98de661b742893773d760d/src/oled-exp.js%23L91
CVE ID: CVE-2021-23378 State: PUBLISHED Published: 2021-04-18T18:40:14.311483Z Last Updated: 2024-09-16T16:58:52.663Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: picotts Problem Types: Arbitrary Command Injection Description: This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PICOTTS-1078539 - https://github.com/luisivan/node-picotts/blob/8c6b
ntainer: References: - https://snyk.io/vuln/SNYK-JS-PICOTTS-1078539 - https://github.com/luisivan/node-picotts/blob/8c6b183b884890c8e9422f93036b374942398c8b/index.js%23L16