Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
15152 - https://github.com/trannamtrung1st/elFinder.Net.Core/commit/5498c8a86b76ef089cfbd7ef8be014b61fa11c73 - https://github.com/trannamtrung1st/elFinder.Net.Core/releases/tag/all-1.2.4
CVE ID: CVE-2021-23408 State: PUBLISHED Published: 2021-07-21T15:35:12.141012Z Last Updated: 2024-09-16T18:44:49.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: n/a Products: com.graphhopper:graphhopper-web-bundle Problem Types: Prototype Pollution Description: This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114 - https://github.com/graphhopper/graphhopper
tainer: References: - https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114 - https://github.com/graphhopper/graphhopper/pull/2370 - https://github.com/graphhopper/graphhopper/releases/tag/3.2 - https://github.com/graphhopper/graphhopper/releases/tag/3.1
CVE ID: CVE-2021-23409 State: PUBLISHED Published: 2021-07-21T06:45:18.241761Z Last Updated: 2024-09-16T20:07:39.351Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: github.com/pires/go-proxyproto Problem Types: Denial of Service (DoS) Description: The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439 - https://github.com/pires/go-proxyproto/releases/tag/v0.6.0 - https://github.com/pires/go-proxyproto/issues/65 -
16439 - https://github.com/pires/go-proxyproto/releases/tag/v0.6.0 - https://github.com/pires/go-proxyproto/issues/65 - https://github.com/pires/go-proxyproto/pull/74 - https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346
CVE ID: CVE-2021-23410 State: REJECTED Published: 2021-07-21T16:45:11 Last Updated: 2021-08-03T14:23:09 Description: No description available.
CVE ID: CVE-2021-23411 State: PUBLISHED Published: 2021-07-21T14:50:11.146051Z Last Updated: 2024-09-16T16:38:34.717Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: anchorme Problem Types: Cross-site Scripting (XSS) Description: Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ANCHORME-1311008 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1320695 -
er: References: - https://snyk.io/vuln/SNYK-JS-ANCHORME-1311008 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1320695 - https://github.com/alexcorvi/anchorme.js/blob/gh-pages/src/transform.ts%23L81
CVE ID: CVE-2021-23412 State: PUBLISHED Published: 2021-07-23T16:00:13.422956Z Last Updated: 2024-09-16T19:50:57.742Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: gitlogplus Problem Types: Command Injection Description: All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832 - https://hackerone.com/reports/808942 - https://www.npmjs.com/package/gitlogplus
CVE ID: CVE-2021-23413 State: PUBLISHED Published: 2021-07-25T13:10:12.559070Z Last Updated: 2024-09-16T19:56:45.208Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: jszip Problem Types: Denial of Service (DoS) Description: This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSZIP-1251497 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499 -
IP-1251497 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499 - https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88 - https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36 - https://github.com/Stuk/jszip/pull/766
CVE ID: CVE-2021-23414 State: PUBLISHED Published: 2021-07-28T07:20:11.321759Z Last Updated: 2024-09-16T23:46:55.457Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: video.js Problem Types: Cross-site Scripting (XSS) Description: This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588 - https://github.com/videojs/video.js/commit/b3acf663641fca0f
7 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588 - https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE ID: CVE-2021-23415 State: PUBLISHED Published: 2021-07-28T16:05:23.804073Z Last Updated: 2024-09-16T17:34:27.189Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O) Vendors: n/a Products: elFinder.AspNet Problem Types: Directory Traversal Description: This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-ELFINDERASPNET-1315153 - https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720
CVE ID: CVE-2021-23416 State: PUBLISHED Published: 2021-07-28T16:05:18.125958Z Last Updated: 2024-09-17T03:02:30.900Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: curly-bracket-parser Problem Types: Cross-site Scripting (XSS) Description: This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CURLYBRACKETPARSER-1297106 - https://github.com/magynhard/curly-bracket-parser/blob/master/src/curly-bracket-parser/curly-bracket-parser.js%23L31
CVE ID: CVE-2021-23417 State: PUBLISHED Published: 2021-07-28T16:05:12.202819Z Last Updated: 2024-09-16T21:07:40.886Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: deepmergefn Problem Types: Prototype Pollution Description: All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DEEPMERGEFN-1310984 - https://github.com/jesusgm/deepmergefn/blob/master/index.js%23L6
CVE ID: CVE-2021-23418 State: PUBLISHED Published: 2021-07-29T17:50:12.851255Z Last Updated: 2024-09-16T17:38:39.943Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: Glances Problem Types: XML External Entity (XXE) Injection Description: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807 - https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94 - https://github.com/nicolar
1807 - https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94 - https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a - https://github.com/nicolargo/glances/issues/1025 - https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32
CVE ID: CVE-2021-23419 State: PUBLISHED Published: 2021-08-08T07:30:12.077212Z Last Updated: 2024-09-16T18:39:41.932Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: open-graph Problem Types: Prototype Pollution Description: This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747 - https://github.com/samholmes/node-open-graph/commit/a0cef507a90adaac7dbbe9c404f09a50bdefb348
CVE ID: CVE-2021-23420 State: PUBLISHED Published: 2021-08-11T12:15:12.647490Z Last Updated: 2024-09-16T17:33:12.400Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C) Vendors: n/a Products: codeception/codeception Problem Types: Deserialization of Untrusted Data Description: This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JinYiTong/poc - https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1
ogram Container: References: - https://github.com/JinYiTong/poc - https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1324585 - https://github.com/Codeception/Codeception/blob/4.1/ext/RunProcess.php%23L52 - https://github.com/Codeception/Codeception/pull/6241
CVE ID: CVE-2021-23421 State: PUBLISHED Published: 2021-08-11T17:30:11.828432Z Last Updated: 2024-09-17T02:42:41.799Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R) Vendors: n/a Products: merge-change Problem Types: Prototype Pollution Description: All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MERGECHANGE-1310985 - https://github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.js%23L89-L123
CVE ID: CVE-2021-23422 State: PUBLISHED Published: 2021-08-16T08:00:11.661564Z Last Updated: 2024-09-16T17:43:18.647Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: bikeshed Problem Types: Arbitrary Code Injection Description: This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd - https://snyk.io/vuln/SNYK-PY
: - https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd - https://snyk.io/vuln/SNYK-PYTHON-BIKESHED-1537646
CVE ID: CVE-2021-23423 State: PUBLISHED Published: 2021-08-16T07:55:09.998782Z Last Updated: 2024-09-17T02:52:59.989Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: n/a Products: bikeshed Problem Types: Directory Traversal Description: This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-BIKESHED-1537647 - https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb
.io/vuln/SNYK-PYTHON-BIKESHED-1537647 - https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd
CVE ID: CVE-2021-23424 State: PUBLISHED Published: 2021-08-18T16:15:17.036756Z Last Updated: 2024-09-16T17:38:46.238Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: ansi-html Problem Types: Regular Expression Denial of Service (ReDoS) Description: This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Tjatse/ansi-html/issues/19 - https://snyk.io/vuln/SNYK-JS-ANSIHTML-1296849 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1567198
CVE ID: CVE-2021-23425 State: PUBLISHED Published: 2021-08-18T16:15:11.284445Z Last Updated: 2024-09-16T23:10:48.912Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: trim-off-newlines Problem Types: Regular Expression Denial of Service (ReDoS) Description: All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TRIMOFFNEWLINES-1296850 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1567197 - https://github.com/stevemao/trim-off-newlines/blob/master/index.js%23L6
CVE ID: CVE-2021-23426 State: PUBLISHED Published: 2021-09-01T14:25:10.624230Z Last Updated: 2024-09-16T23:16:46.634Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: Proto Problem Types: Prototype Pollution Description: This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PROTO-1316301 - https://www.npmjs.com/package/Proto
CVE ID: CVE-2021-23427 State: PUBLISHED Published: 2021-09-01T14:30:17.562183Z Last Updated: 2024-09-16T16:38:08.993Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C) Vendors: n/a Products: elFinder.NetCore Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1567778 - https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730e
vuln/SNYK-DOTNET-ELFINDERNETCORE-1567778 - https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L226
CVE ID: CVE-2021-23428 State: PUBLISHED Published: 2021-09-01T14:30:12.041928Z Last Updated: 2024-09-16T22:24:58.738Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C) Vendors: n/a Products: elFinder.NetCore Problem Types: Directory Traversal Description: This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838 - https://gith
st Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-ELFINDERNETCORE-1313838 - https://github.com/gordon-matt/elFinder.NetCore - https://github.com/gordon-matt/elFinder.NetCore/blob/633da9a4d7d5c9baefd1730ee51bf7af54889600/elFinder.NetCore/Drivers/FileSystem/FileSystemDriver.cs%23L387
CVE ID: CVE-2021-23429 State: PUBLISHED Published: 2021-08-24T07:45:30.319337Z Last Updated: 2024-09-16T20:21:41.063Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: transpile Problem Types: Denial of Service (DoS) Description: All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TRANSPILE-1290774 - https://github.com/stealjs/transpile/blob/56aaeb26f69496e45a60c03dc92653d53021d4ac/main.js%23L53
CVE ID: CVE-2021-23430 State: PUBLISHED Published: 2021-08-24T07:45:24.211749Z Last Updated: 2024-09-17T01:31:45.294Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: startserver Problem Types: Directory Traversal Description: All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-STARTSERVER-1296388 - https://github.com/xudafeng/startserver/blob/bef0c4e4d21da42a40ce87cf25fd54ac8d8cb2d8/lib/index.js%23L71
CVE ID: CVE-2021-23431 State: PUBLISHED Published: 2021-08-24T07:45:19.101596Z Last Updated: 2024-09-17T03:48:53.451Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: joplin Problem Types: Cross-site Request Forgery (CSRF) Description: The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JOPLIN-1325537 - https://github.com/laurent22/joplin/commit/19b45de2981c09f6f387498ef96d32b4811eba5e
CVE ID: CVE-2021-23432 State: PUBLISHED Published: 2021-08-24T08:50:09.159026Z Last Updated: 2024-09-16T16:33:12.637Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: mootools Problem Types: Prototype Pollution Description: This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge() Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MOOTOOLS-1325536
CVE ID: CVE-2021-23433 State: PUBLISHED Published: 2021-11-19T19:25:12.337780Z Last Updated: 2024-09-16T19:45:53.608Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: algoliasearch-helper Problem Types: Prototype Pollution Description: The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns. Additional Analyst Notes: - CVE Program Container: Referenc
ementation allows users to define arbitrary search patterns. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421 - https://github.com/algolia/algoliasearch-helper-js/blob/3.5.5/src/SearchParameters/index.js%23L291 - https://github.com/algolia/algoliasearch-helper-js/commit/4ff542b70b92a6b81cce8b9255700b0bc0817edd
CVE ID: CVE-2021-23434 State: PUBLISHED Published: 2021-08-27T16:50:13.019035Z Last Updated: 2024-09-16T16:48:40.220Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: object-path Problem Types: Prototype Pollution Description: This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different. Additional Analyst Notes: - CVE Progra
the === operator returns always false when the type of the operands is different. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423 - https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb - https://github.com/mariocasciaro/object-path%230116 - https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
CVE ID: CVE-2021-23435 State: PUBLISHED Published: 2021-09-12T20:05:10.404742Z Last Updated: 2024-09-16T23:55:46.556Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: n/a Products: clearance Problem Types: Open Redirect Description: This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-CLE
http://example.com). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-CLEARANCE-1577284 - https://github.com/thoughtbot/clearance/pull/945
CVE ID: CVE-2021-23436 State: PUBLISHED Published: 2021-09-01T17:30:09.902397Z Last Updated: 2024-09-16T16:28:32.515Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: immer Problem Types: Prototype Pollution Description: This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false
hes_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-IMMER-1540542 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266 - https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237
CVE ID: CVE-2021-23437 State: PUBLISHED Published: 2021-09-03T16:10:10.293816Z Last Updated: 2024-09-16T20:47:41.102Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Pillow Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443 - https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html - https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b - https:/