Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25871 State: PUBLISHED Published: 2022-06-17T20:05:34.384841Z Last Updated: 2024-09-17T00:05:54.947Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: querymen Problem Types: Prototype Pollution Description: All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391
MEN-559867). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488
CVE ID: CVE-2022-25872 State: PUBLISHED Published: 2022-06-17T20:05:23.831263Z Last Updated: 2024-09-16T16:18:30.280Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P) Vendors: n/a Products: fast-string-search Problem Types: Out-of-bounds Read Description: All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368 - https://github.com/magiclen/node-fast-string-search/blob/c
es: - https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368 - https://github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192
CVE ID: CVE-2022-25873 State: PUBLISHED Published: 2022-09-18T14:55:10.826445Z Last Updated: 2024-09-17T03:28:38.073Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: vuetify Problem Types: Cross-site Scripting (XSS) Description: The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-VUETIFY-3019858 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406 - https://security.snyk.io/vuln/SNYK-JAV
VUETIFY-3019858 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3024406 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVUETIFYJS-3024407 - https://github.com/vuetifyjs/vuetify/commit/ade1434927f55a0eccf3d54f900f24c5fa85a176 - https://github.com/vuetifyjs/vuetify/issues/15757 - https://codepen.io/5v3n-08/pen/MWGKEjY
CVE ID: CVE-2022-25875 State: PUBLISHED Published: 2022-07-12T14:20:17.950532Z Last Updated: 2024-09-17T04:14:01.708Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: svelte Problem Types: Cross-site Scripting (XSS) Description: The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SVELTE-2931080 - https://github.
onal Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SVELTE-2931080 - https://github.com/sveltejs/svelte/pull/7530%23issuecomment-1158575990 - https://github.com/sveltejs/svelte/commit/f8605d6acbf66976da9b4547f76e90e163899907
CVE ID: CVE-2022-25876 State: PUBLISHED Published: 2022-07-01T20:00:22.396158Z Last Updated: 2024-09-17T01:56:48.134Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: link-preview-js Problem Types: Server-side Request Forgery (SSRF) Description: The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ospfranco/link-preview-js/issues/115 - https://snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-
ner: References: - https://github.com/ospfranco/link-preview-js/issues/115 - https://snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-2933520 - https://github.com/ospfranco/link-preview-js/pull/117
CVE ID: CVE-2022-25878 State: PUBLISHED Published: 2022-05-27T20:00:15.716414Z Last Updated: 2024-09-17T02:36:03.191Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P) Vendors: n/a Products: protobufjs Problem Types: Prototype Pollution Description: The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vul
2. by parsing/loading .proto files Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507 - https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197 - https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f - https://github.com/protobufjs/protobuf.js/pull/1731
CVE ID: CVE-2022-25880 State: PUBLISHED Published: 2022-03-29T16:37:06.548Z Last Updated: 2025-04-16T16:36:44.618Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-25881 State: PUBLISHED Published: 2023-01-31T05:00:01.220Z Last Updated: 2025-03-27T17:16:32.835Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: http-cache-semantics, org.webjars.npm:http-cache-semantics Problem Types: CWE-1333 Description: This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783 - https:
tainer: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332 - https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83 - https://security.netapp.com/advisory/ntap-20230622-0008/
CVE ID: CVE-2022-25882 State: PUBLISHED Published: 2023-01-25T05:00:02.847Z Last Updated: 2025-04-01T14:54:07.446Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: onnx Problem Types: CWE-22 Description: Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd" Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 - https://github.com/onnx/onnx/issues/3
lnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 - https://github.com/onnx/onnx/issues/3991 - https://github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129 - https://github.com/onnx/onnx/pull/4400 - https://github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d - https://gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856
CVE ID: CVE-2022-25883 State: PUBLISHED Published: 2023-06-21T05:00:03.352Z Last Updated: 2024-12-06T16:55:09.228Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: semver Problem Types: CWE-1333 Description: Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795 - https://github.com/npm/node-semver/blob/main/internal/re.js%23L160 - https://github.com/npm/node-semver/blob/mai
47795 - https://github.com/npm/node-semver/blob/main/internal/re.js%23L160 - https://github.com/npm/node-semver/blob/main/internal/re.js%23L138 - https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104 - https://github.com/npm/node-semver/pull/564 - https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
CVE ID: CVE-2022-25885 State: PUBLISHED Published: 2022-11-01T05:05:18.156Z Last Updated: 2025-05-05T14:08:27.284Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: muhammara, hummus Problem Types: Denial of Service (DoS) Description: The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137 - https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139 - https://github.com/julianhille/MuhammaraJS/commit/0a64
-3091137 - https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139 - https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c - https://github.com/julianhille/MuhammaraJS/issues/188 - https://github.com/galkahana/HummusJS/issues/439
CVE ID: CVE-2022-25887 State: PUBLISHED Published: 2022-08-30T05:00:20.149607Z Last Updated: 2024-09-17T03:07:00.082Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: sanitize-html Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 - https://github.com/apo
ln/SNYK-JS-SANITIZEHTML-2957526 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102 - https://github.com/apostrophecms/sanitize-html/pull/557 - https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
CVE ID: CVE-2022-25888 State: PUBLISHED Published: 2022-08-23T05:07:40.316746Z Last Updated: 2024-09-16T23:15:19.823Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: opcua Problem Types: Denial of Service (DoS) Description: The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk
sending the Final closing chunk. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988751 - https://github.com/locka99/opcua/pull/216 - https://github.com/locka99/opcua/pull/216/commits/6fb683c5fec46c6dd347824491c4d93a229da695
CVE ID: CVE-2022-25889 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:17:31.097Z Description: No description available.
CVE ID: CVE-2022-25890 State: PUBLISHED Published: 2023-01-09T05:00:01.045Z Last Updated: 2025-04-09T14:07:05.913Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: wifey Problem Types: CWE-78 Description: All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-WIFEY-3175615
CVE ID: CVE-2022-25891 State: PUBLISHED Published: 2022-07-15T20:01:13.777476Z Last Updated: 2024-09-17T02:37:27.360Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: github.com/containrrr/shoutrrr/pkg/util Problem Types: Denial of Service (DoS) Description: The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 -
s: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 - https://github.com/containrrr/shoutrrr/issues/240 - https://github.com/containrrr/shoutrrr/pull/242 - https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42 - https://github.com/containrrr/shoutrrr/releases/tag/v0.6.0
CVE ID: CVE-2022-25892 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T19:49:28.115Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: muhammara, hummus Problem Types: Denial of Service (DoS) Description: The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320 - https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138 - https://github.c
ecurity.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320 - https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138 - https://github.com/julianhille/MuhammaraJS/issues/214 - https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002 - https://github.com/galkahana/HummusJS/issues/463 - https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51
CVE ID: CVE-2022-25893 State: PUBLISHED Published: 2022-12-21T23:14:33.786Z Last Updated: 2025-04-15T19:18:16.546Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: vm2 Problem Types: Arbitrary Code Execution Description: The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-VM2-2990237 - https://github.com/patriksimek/vm2/issues/444 -
hment: References: - https://security.snyk.io/vuln/SNYK-JS-VM2-2990237 - https://github.com/patriksimek/vm2/issues/444 - https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69 - https://github.com/patriksimek/vm2/pull/445
CVE ID: CVE-2022-25894 State: PUBLISHED Published: 2023-01-25T05:00:03.528Z Last Updated: 2025-04-01T14:53:31.776Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: com.bstek.uflo:uflo-core Problem Types: CWE-94 Description: All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMBSTEKUFLO-3091112 - https://github.com/youser
ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMBSTEKUFLO-3091112 - https://github.com/youseries/uflo/blob/b3e198bc6523e5a6ba69edd84ba10e05a3b78726/uflo-core/src/main/java/com/bstek/uflo/expr/impl/ExpressionContextImpl.java%23L126 - https://fmyyy1.github.io/2022/10/23/uflo2rce/
CVE ID: CVE-2022-25895 State: PUBLISHED Published: 2022-12-21T23:14:33.786Z Last Updated: 2025-04-16T18:32:59.442Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: lite-dev-server Problem Types: Directory Traversal Description: All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718 - https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.j
urity.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718 - https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134 - https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120
CVE ID: CVE-2022-25896 State: PUBLISHED Published: 2022-07-01T20:06:04.981270Z Last Updated: 2024-09-16T17:54:16.737Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: n/a Products: passport Problem Types: Session Fixation Description: This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631 - https://github.com/jaredhanson/passport/pull/900 - https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
CVE ID: CVE-2022-25897 State: PUBLISHED Published: 2022-09-08T05:05:12.190707Z Last Updated: 2024-09-16T17:49:20.074Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: org.eclipse.milo:sdk-server Problem Types: Denial of Service (DoS) Description: The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191 - https://github.co
CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191 - https://github.com/eclipse/milo/pull/1031 - https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5 - https://github.com/eclipse/milo/issues/1030
CVE ID: CVE-2022-25898 State: PUBLISHED Published: 2022-07-01T20:02:03.338204Z Last Updated: 2024-09-16T18:48:35.777Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H/E:P) Vendors: n/a Products: jsrsasign Problem Types: Improper Verification of Cryptographic Signature Description: The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method. Additional Ana
ignature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2935896 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBKJUR-2935897 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2935898 - https://github.com/kjur/jsrsasign/commit/4536a6e9e8bcf1a644ab7c07ed96e453347dae41 - https://github.com/kjur/jsrsasign/releases/tag/10.5.25
CVE ID: CVE-2022-25899 State: PUBLISHED Published: 2022-08-18T19:58:14.000Z Last Updated: 2025-02-25T17:17:23.102Z Vendors: n/a Products: Intel(R) Problem Types: escalation of privilege Description: Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00694.html
CVE ID: CVE-2022-25900 State: PUBLISHED Published: 2022-07-01T20:05:13.319916Z Last Updated: 2024-09-17T04:00:09.068Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: git-clone Problem Types: Command Injection Description: All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GITCLONE-2434308 - https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc
CVE ID: CVE-2022-25901 State: PUBLISHED Published: 2023-01-18T05:00:01.282Z Last Updated: 2025-04-03T19:33:00.360Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: cookiejar, org.webjars.npm:cookiejar Problem Types: CWE-1333 Description: Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681 - https://github.
snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681 - https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73 - https://github.com/bmeck/node-cookiejar/pull/39 - https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5 - https://lists.debian.org/debian-lts-announce/2023/09/msg00008.html
CVE ID: CVE-2022-25903 State: PUBLISHED Published: 2022-08-24T05:00:19.697874Z Last Updated: 2024-09-17T01:45:33.657Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: opcua Problem Types: Denial of Service (DoS) Description: The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/locka99/opcua/pull/216 - https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750 - http
: References: - https://github.com/locka99/opcua/pull/216 - https://security.snyk.io/vuln/SNYK-RUST-OPCUA-2988750 - https://github.com/locka99/opcua/pull/216/commits/e75dada28a40c3fefc4aeee4cdc272e1b748f8dd