Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7656 State: PUBLISHED Published: 2020-05-19T00:00:00 Last Updated: 2024-08-04T09:33:19.995Z Vendors: n/a Products: jquery Problem Types: Cross-site Scripting Description: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20200528-0001/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://snyk.io/vuln/SNYK-JS-JQUERY-569619 - https://supportportal.jun
/www.oracle.com/security-alerts/cpujul2022.html - https://snyk.io/vuln/SNYK-JS-JQUERY-569619 - https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1?language=en_US
CVE ID: CVE-2020-7658 State: PUBLISHED Published: 2020-05-22T15:48:43 Last Updated: 2024-08-04T09:33:19.997Z Vendors: n/a Products: meinheld Problem Types: HTTP Request Smuggling Description: meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mopemope/meinheld/blob/master/CHANGES.rst%2C - https://snyk.io/vuln/SNYK-PYTHON-MEINHELD-569140
CVE ID: CVE-2020-7659 State: PUBLISHED Published: 2020-06-01T12:50:27 Last Updated: 2024-08-04T09:33:20.010Z Vendors: n/a Products: reel Problem Types: HTTP Request Smuggling Description: reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNY
nd is not maintained any more. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-REEL-569135
CVE ID: CVE-2020-7660 State: PUBLISHED Published: 2020-06-01T14:50:55 Last Updated: 2024-08-04T09:33:20.024Z Vendors: n/a Products: serialize-javascript Problem Types: Arbitrary Code Injection Description: serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yahoo/serialize-javascript/commit/f21a6fb3ace2353413761e79717b2d210ba6ccbd
CVE ID: CVE-2020-7661 State: PUBLISHED Published: 2020-06-04T17:15:32 Last Updated: 2024-08-04T09:33:20.033Z Vendors: n/a Products: url-regex Problem Types: Regular Expression Denial of Service Description: all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kevva/url-regex/issues/70 - https://snyk.io/vuln/SNYK-JS-URLREGEX-569472
CVE ID: CVE-2020-7662 State: PUBLISHED Published: 2020-06-02T18:28:46 Last Updated: 2024-08-04T09:33:20.006Z Vendors: n/a Products: websocket-extensions (npm) Problem Types: Regular Expression Denial of Service (ReDoS) Description: websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Ex
t Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions - https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv - https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237 - https://snyk.io/vuln/SNYK-JS-WEBSOCKETEXTENSIONS-570623
CVE ID: CVE-2020-7663 State: PUBLISHED Published: 2020-06-02T18:25:01 Last Updated: 2024-08-04T09:33:20.058Z Vendors: n/a Products: websocket-extensions (ruby) Problem Types: Regular Expression Denial of Service (ReDoS) Description: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-
uct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2 - https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a8131892418838b - https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions - https://snyk.io/vuln/SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 - https://lists.debian.org/debian-lts-announce/2020/08/msg00031.html - https://usn.ubuntu.com/4502-1/
CVE ID: CVE-2020-7664 State: PUBLISHED Published: 2020-06-17T16:00:17.220529Z Last Updated: 2024-09-17T02:26:16.941Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: github.com/unknwon/cae/zip Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAEZIP-570383
CVE ID: CVE-2020-7665 State: PUBLISHED Published: 2020-09-01T13:55:13.737721Z Last Updated: 2024-09-16T23:15:21.354Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: github.com/u-root/u-root/pkg/uzip Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGUZIP-570441 - https://github.com/u-root/u-root/pull/1817
CVE ID: CVE-2020-7666 State: PUBLISHED Published: 2020-09-01T13:55:17.641462Z Last Updated: 2024-09-16T20:41:57.886Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: github.com/u-root/u-root/pkg/cpio Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/u-root/u-root/pull/1817 - https://snyk.io/vuln/SNYK-G
t Notes: - CVE Program Container: References: - https://github.com/u-root/u-root/pull/1817 - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGCPIO-570440
CVE ID: CVE-2020-7667 State: PUBLISHED Published: 2020-06-24T12:00:15.519943Z Last Updated: 2024-09-17T02:48:08.483Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: github.com/sassoftware/go-rpmutils/cpio Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released. Additional Analyst Notes: -
ectory. Note: the fixing commit was applied to all affected versions which were re-released. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427 - https://github.com/sassoftware/go-rpmutils/commit/a64058cf21b8aada501bba923c9aab66fb6febf0
CVE ID: CVE-2020-7668 State: PUBLISHED Published: 2020-06-17T16:00:21.626960Z Last Updated: 2024-09-17T02:05:34.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: github.com/unknwon/cae/tz Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384
CVE ID: CVE-2020-7669 State: PUBLISHED Published: 2020-09-01T13:55:21.545180Z Last Updated: 2024-09-16T17:34:29.139Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: github.com/u-root/u-root/pkg/tarutil Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/u-root/u-root/pull/1817 - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGTARUTIL-570428
CVE ID: CVE-2020-7670 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:00.497Z Vendors: n/a Products: agoo Problem Types: HTTP Request Smuggling Description: agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing. Additional Analyst Notes: - CVE Program Container: Refe
o insufficient `Content-Length` and `Transfer Encoding` parsing. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-AGOO-569137 - https://github.com/ohler55/agoo/issues/88 - https://github.com/ohler55/agoo/commit/23d03535cf7b50d679a60a953a0cae9519a4a130
CVE ID: CVE-2020-7671 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:01.215Z Vendors: n/a Products: goliath Problem Types: HTTP Request Smuggling Description: goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/postrank-labs/goliath/issues/351%2C - https://snyk.io/vu
otes: - CVE Program Container: References: - https://github.com/postrank-labs/goliath/issues/351%2C - https://snyk.io/vuln/SNYK-RUBY-GOLIATH-569136
CVE ID: CVE-2020-7672 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:00.471Z Vendors: n/a Products: mosc Problem Types: Arbitrary Code Execution Description: mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MOSC-571492
CVE ID: CVE-2020-7673 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:01.259Z Vendors: n/a Products: node-extend Problem Types: Arbitrary Code Execution Description: node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-NODEEXTEND-571491
CVE ID: CVE-2020-7674 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:01.575Z Vendors: n/a Products: access-policy Problem Types: Arbitrary Code Execution Description: access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ACCESSPOLICY-571490
CVE ID: CVE-2020-7675 State: PUBLISHED Published: 2020-06-10T15:36:01 Last Updated: 2024-08-04T09:41:01.423Z Vendors: n/a Products: cd-messenger Problem Types: Arbitrary Code Execution Description: cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CDMESSENGER-571493
CVE ID: CVE-2020-7676 State: PUBLISHED Published: 2020-06-08T13:34:09 Last Updated: 2024-08-04T09:41:01.655Z Vendors: n/a Products: angular.js Problem Types: Cross-site Scripting Description: angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/angular/angular.js/pull/17028%2C - https://snyk.io/vuln/SNYK-JS-ANGULAR-570058 - https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b
vuln/SNYK-JS-ANGULAR-570058 - https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/r3f05cfd587c774ea83c18e59eda9fa37fa9bbf3421484d4ee1017a20%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r57383582dcad2305430321589dfaca6793f5174c55da6ce8d06fbf9b%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r198985c02829ba8285ed4f9b1de54a33b5f31b08bb38ac51fc86961b%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r79e3feaaf87b81e80da0e17a579015f6dcb94c95551ced398d50c8d7%40%3Cozone-issues.hadoop.apache.org%3E
.apache.org/thread.html/r79e3feaaf87b81e80da0e17a579015f6dcb94c95551ced398d50c8d7%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r455ebd83a1c69ae8fd897560534a079c70a483dbe1e75504f1ca499b%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rb6423268b25db0f800359986867648e11dbd38e133b9383e85067f02%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r80f210a5f4833d59c5d3de17dd7312f9daba0765ec7d4052469f13f1%40%3Cozone-commits.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r446c297cd6cda2bd7e345c9b0741d7f611df89902e5d515848c6f4b1%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.
cda2bd7e345c9b0741d7f611df89902e5d515848c6f4b1%40%3Cozone-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rfa2b19d01d10a8637dc319a7d5994c3dbdb88c0a8f9a21533403577a%40%3Cozone-issues.hadoop.apache.org%3E
CVE ID: CVE-2020-7677 State: PUBLISHED Published: 2022-07-25T14:08:22.131877Z Last Updated: 2024-09-16T17:34:23.113Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: thenify Problem Types: Arbitrary Code Execution Description: This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - https://github.com/th
yk.io/vuln/SNYK-JS-THENIFY-571690 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - https://github.com/thenables/thenify/blob/master/index.js%23L17 - https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a - https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
CVE ID: CVE-2020-7678 State: PUBLISHED Published: 2022-07-25T14:07:56.881504Z Last Updated: 2024-09-17T01:36:04.103Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C) Vendors: n/a Products: node-import Problem Types: Arbitrary Code Execution Description: This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js". Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691 - https://github.com/mahdaen/node-import/blob/mas
References: - https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691 - https://github.com/mahdaen/node-import/blob/master/index.js%23L79
CVE ID: CVE-2020-7679 State: PUBLISHED Published: 2020-06-19T10:40:12.622167Z Last Updated: 2024-09-16T23:51:13.919Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: casperjs Problem Types: Prototype Pollution Description: In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-572804 - https://snyk.io/vuln/SNYK-JS-CASPERJS-572803 - https://github.com/casperjs/casperjs/blob/master/modules/utils.js%23L680
CVE ID: CVE-2020-7680 State: PUBLISHED Published: 2020-07-20T15:22:13 Last Updated: 2024-08-04T09:41:01.274Z Vendors: n/a Products: docsify Problem Types: Cross-site Scripting (XSS) Description: docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/docsifyjs/docsify/issues/1126 - https://github.com/docsifyjs/docsify/
rogram Container: References: - https://github.com/docsifyjs/docsify/issues/1126 - https://github.com/docsifyjs/docsify/pull/1128 - https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099 - http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2021/Feb/71 - http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html
CVE ID: CVE-2020-7681 State: PUBLISHED Published: 2020-07-25T08:35:19.851795Z Last Updated: 2024-09-16T17:38:44.120Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: marscode Problem Types: Directory Traversal Description: This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MARSCODE-590122
CVE ID: CVE-2020-7682 State: PUBLISHED Published: 2020-07-25T08:35:15.733179Z Last Updated: 2024-09-16T17:14:43.160Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: marked-tree Problem Types: Directory Traversal Description: This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MARKEDTREE-590121
CVE ID: CVE-2020-7683 State: PUBLISHED Published: 2020-07-25T08:35:11.561627Z Last Updated: 2024-09-17T00:10:30.186Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: rollup-plugin-server Problem Types: Directory Traversal Description: This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ROLLUPPLUGINSERVER-590123
CVE ID: CVE-2020-7684 State: PUBLISHED Published: 2020-07-17T07:25:11.671205Z Last Updated: 2024-09-17T04:14:15.510Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P) Vendors: n/a Products: rollup-plugin-serve Problem Types: Directory Traversal Description: This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FASTHTTP-572886
CVE ID: CVE-2020-7685 State: PUBLISHED Published: 2020-07-28T16:25:15.127223Z Last Updated: 2024-09-16T17:14:53.209Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: UmbracoForms Problem Types: Insecure Defaults Description: This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies. Additional Analyst Notes: - CVE Program Container: Referen
n file types, depending on their security needs and policies. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-DOTNET-UMBRACOFORMS-595765
CVE ID: CVE-2020-7686 State: PUBLISHED Published: 2020-07-25T08:40:12.726432Z Last Updated: 2024-09-16T18:24:05.187Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: rollup-plugin-dev-server Problem Types: Directory Traversal Description: This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ROLLUPPLUGINDEVSERVER-590124