Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26282 State: PUBLISHED Published: 2020-12-24T20:45:18 Last Updated: 2024-08-04T15:56:04.075Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: browserup Products: browserup-proxy Problem Types: CWE-74 Description: BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) v
oxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hq - https://securitylab.github.com/research/bean-validation-RCE - https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2 - https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578ab
CVE ID: CVE-2020-26283 State: PUBLISHED Published: 2021-03-24T20:30:19 Last Updated: 2024-08-04T15:56:04.593Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: ipfs Products: go-ipfs Problem Types: CWE-116 Description: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipfs/go-ipfs/securi
n version 0.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm - https://github.com/ipfs/go-ipfs/pull/7831 - https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
CVE ID: CVE-2020-26284 State: PUBLISHED Published: 2020-12-21T22:40:15 Last Updated: 2024-08-04T15:56:03.976Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: gohugoio Products: hugo Problem Types: CWE-78 Description: Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows
rking directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq - https://github.com/golang/go/issues/38736
CVE ID: CVE-2020-26285 State: PUBLISHED Published: 2021-01-21T13:30:17 Last Updated: 2024-08-04T15:56:04.104Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-22, CWE-434 Description: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved Additional Analyst Notes: - C
the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hj6w-xrv3-wjj9 - https://github.com/OpenMage/magento-lts/commit/4132668f5009f17456fe644742026f56d2297586 - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10
CVE ID: CVE-2020-26286 State: PUBLISHED Published: 2020-12-28T23:25:13 Last Updated: 2024-08-04T15:56:04.326Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: hedgedoc Products: hedgedoc Problem Types: CWE-434 Description: HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/u
y contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc - https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 - https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8
CVE ID: CVE-2020-26287 State: PUBLISHED Published: 2020-12-28T23:30:17 Last Updated: 2024-08-04T15:56:03.991Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: hedgedoc Products: hedgedoc Problem Types: CWE-79 Description: HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the
Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 - https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p - https://github.com/hackmdio/codimd/issues/1630 - https://github.com/Alemmi/ctf-writeup
/advisories/GHSA-g6w6-7xf9-m95p - https://github.com/hackmdio/codimd/issues/1630 - https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.md - https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4
CVE ID: CVE-2020-26288 State: PUBLISHED Published: 2020-12-30T19:25:17 Last Updated: 2024-08-04T15:56:04.546Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-312 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage. Additional Analyst Notes: - CVE Program Container: References: - https:
ntication to prevent cleartext password storage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3 - https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a - https://github.com/parse-community/parse-server/releases/tag/4.5.0 - https://www.npmjs.com/package/parse-server
CVE ID: CVE-2020-26289 State: PUBLISHED Published: 2020-12-28T18:50:15 Last Updated: 2024-08-04T15:56:04.321Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: knowledgecode Products: date-and-time Problem Types: CWE-400 Description: date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/knowledgecode/date-and-time/security/advisories/GHSA-r92x-f52r-x54g - https://github.com/knowledgecode/date-and-
hub.com/knowledgecode/date-and-time/security/advisories/GHSA-r92x-f52r-x54g - https://github.com/knowledgecode/date-and-time/commit/9e4b501eacddccc8b1f559fb414f48472ee17c2a - https://www.npmjs.com/package/date-and-time
CVE ID: CVE-2020-26290 State: PUBLISHED Published: 2020-12-28T19:15:17 Last Updated: 2024-08-04T15:56:04.350Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: dexidp Products: dex Problem Types: CWE-347 Description: Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library. The vulnerabilities have been addressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references). Additional Ana
ddressed in version 2.27.0 by using the xml-roundtrip-validator from Mattermost (see related references). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md - https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md - https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ - https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 - https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gm
x/security/advisories/GHSA-m9hp-7r99-94h5 - https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 - https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8 - https://github.com/dexidp/dex/releases/tag/v2.27.0
CVE ID: CVE-2020-26291 State: PUBLISHED Published: 2020-12-30T23:40:16 Last Updated: 2024-08-04T15:56:03.814Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: medialize Products: URI.js Problem Types: CWE-20 Description: URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the
pacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.] Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mediali
rable to a payload variant.] Additional Analyst Notes: - CVE Program Container: References: - https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg - https://www.npmjs.com/package/urijs - https://github.com/medialize/URI.js/releases/tag/v1.19.4 - https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155
CVE ID: CVE-2020-26292 State: PUBLISHED Published: 2021-01-04T18:10:12 Last Updated: 2024-08-04T15:56:04.400Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: chatter-social Products: Creeper Problem Types: CWE-507 Description: Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you ha
ected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chatter-social/Creeper/security/advisories/GHSA-9v67-g2rg-m33j
CVE ID: CVE-2020-26293 State: PUBLISHED Published: 2021-01-04T18:20:14 Last Updated: 2024-08-04T15:56:03.977Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: mganss Products: HtmlSanitizer Problem Types: CWE-74 Description: HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not expl
passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mganss/HtmlSanitizer/security/advisories/GHSA-8j9v-h2vp-2hhv - https://www.nuget.org/packages/HtmlSanitizer/ - https://github.com/mganss/HtmlSanitizer/releases/tag/v5.0.372 - https://github.com/mganss/HtmlSanitizer/commit/a3a7602a44d4155d51ec0fbbedc2a49e9c7e2eb8
CVE ID: CVE-2020-26294 State: PUBLISHED Published: 2021-01-04T18:35:14 Last Updated: 2024-08-04T15:56:03.799Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: go-vela Products: compiler Problem Types: CWE-78 Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to ro
referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-vela/compiler/security/advisories/GHSA-gv2h-gf8m-r68j - https://github.com/go-vela/compiler/commit/f1ace5f8a05c95c4d02264556e38a959ee2d9bda - https://pkg.go.dev/github.com/go-vela/compiler/compiler
CVE ID: CVE-2020-26295 State: PUBLISHED Published: 2021-01-21T13:40:19 Last Updated: 2024-08-04T15:56:03.804Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-22, CWE-434 Description: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/r
Issue solved Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.10 - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-52c6-6v3v-f3fg - https://github.com/OpenMage/magento-lts/commit/9cf8c0aa1d1306051a18ace08d40279dadc1fb35
CVE ID: CVE-2020-26296 State: PUBLISHED Published: 2020-12-30T23:10:16 Last Updated: 2024-08-04T15:56:04.125Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: vega Products: vega Problem Types: CWE-79 Description: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.
achine. This is fixed in version 5.17.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vega/vega/security/advisories/GHSA-r2qc-w64x-6j54 - https://github.com/vega/vega/issues/3018 - https://github.com/vega/vega/pull/3019 - https://github.com/vega/vega/releases/tag/v5.17.3 - https://www.npmjs.com/package/vega
CVE ID: CVE-2020-26297 State: PUBLISHED Published: 2021-01-04T18:45:15 Last Updated: 2024-08-04T15:56:04.096Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: rust-lang Products: mdBook Problem Types: CWE-79 Description: mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page. The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on
) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436 - https://groups.google.com/g/rustlang-security-announceme
.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436 - https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 - https://crates.io/crates/mdbook - https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045 - https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b
CVE ID: CVE-2020-26298 State: PUBLISHED Published: 2021-01-11T00:00:00.000Z Last Updated: 2025-02-13T16:27:42.195Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: vmg Products: redcarpet Problem Types: CWE-74, CWE-79 Description: Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit. Additional Analyst Notes: - CVE Program Container: Reference
d. This is fixed in version 3.5.1 by the referenced commit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/advisories/GHSA-q3wr-qw3g-3p4h - https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793 - https://rubygems.org/gems/redcarpet - https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security - https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html - https://www.debian.org/security/2021/dsa-4831 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/
CVE ID: CVE-2020-26299 State: PUBLISHED Published: 2021-02-10T18:10:19 Last Updated: 2024-08-04T15:56:04.494Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: autovance Products: ftp-srv Problem Types: CWE-22 Description: ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, CWD and UPDR. When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user
hen windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. The issue is patched in version 4.4.0 (commit 457b859450a37cba10ff3c431eb4aa67771122e3). Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/ftp-srv - https://github.com/autovance/ftp-srv/security/advisories/GHSA-pmw4-jgxx-pcq9 - https://github.com/autovance/ftp-srv/issues/167 - https://github.com/autovance/ftp-srv/issues/225 - https://github.com/autovance/ftp-srv/pull/224 - https://github.com/autovance/f
github.com/autovance/ftp-srv/issues/225 - https://github.com/autovance/ftp-srv/pull/224 - https://github.com/autovance/ftp-srv/commit/457b859450a37cba10ff3c431eb4aa67771122e3
CVE ID: CVE-2020-26300 State: PUBLISHED Published: 2021-09-09T01:10:11 Last Updated: 2024-08-04T15:56:03.706Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-77 Description: systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/systeminformation - https://github.com/advisories/GHSA-fj59-f6c3-3vw4 - https:/
erences: - https://www.npmjs.com/package/systeminformation - https://github.com/advisories/GHSA-fj59-f6c3-3vw4 - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-fj59-f6c3-3vw4 - https://github.com/sebhildebrandt/systeminformation/commit/bad372e654cdd549e7d786acbba0035ded54c607