deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-17526
Published: 2020-12-21
Description: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
CVSS Score: 7.7 (HIGH)
References: http://www.openwall.com/lists/oss-security/2020/12/21/1; https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-26263
Published: 2020-12-21
Description: tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/tlsfuzzer/tlslite-ng/commit/c28d6d387bba59d8bd5cb3ba15edc42edf54b368; https://github.com/tlsfuzzer/tlslite-ng/pull/438; https://github.com/tlsfuzzer/tlslite-ng/pull/439
CVE: CVE-2020-35497
Published: 2020-12-21
Description: A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1908755; https://bugzilla.redhat.com/show_bug.cgi?id=1908755
CVE: CVE-2020-14225
Published: 2020-12-21
Description: HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vulnerability to trick the end user into entering sensitive information such as credentials, e.g. as part of a phishing attack.
CVSS Score: 6.5 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085915; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085915
CVE: CVE-2020-25860
Published: 2020-12-21
Description: The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv; https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework; https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv
CVE: CVE-2020-26275
Published: 2020-12-21
Description: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://advisory.checkmarx.net/advisory/CX-2020-4291; https://github.com/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca; https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-pc2c
CVE: CVE-2020-26422
Published: 2020-12-21
Description: Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
CVSS Score: 3.7 (LOW)
CWE: CWE-120
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.json; https://gitlab.com/wireshark/wireshark/-/issues/17073; https://security.gentoo.org/glsa/202101-12
CVE: CVE-2020-27254
Published: 2020-12-21
Description: Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authentication for accessing log and backup data, which could allow an attacker with a specially crafted URL to obtain access to sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01
CVE: CVE-2020-4555
Published: 2020-12-21
Description: IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183328; https://www.ibm.com/support/pages/node/6388702; https://www.ibm.com/support/pages/node/6388704
CVE: CVE-2020-4757
Published: 2020-12-21
Description: IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188600.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188600; https://www.gosecure.net/blog/2022/06/21/xss-vulnerability-in-ibm-content-navigator-cve-2020-4757/; https://www.ibm.com/support/pages/node/6388806
CVE: CVE-2020-4794
Published: 2020-12-21
Description: IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization checking. IBM X-Force ID: 189445.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189445; https://www.ibm.com/support/pages/node/6359463; https://exchange.xforce.ibmcloud.com/vulnerabilities/189445
CVE: CVE-2020-4840
Published: 2020-12-21
Description: IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 190044.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190044; https://www.ibm.com/support/pages/node/6336251; https://exchange.xforce.ibmcloud.com/vulnerabilities/190044
CVE: CVE-2020-4841
Published: 2020-12-21
Description: IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 190045.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190045; https://www.ibm.com/support/pages/node/6336251; https://exchange.xforce.ibmcloud.com/vulnerabilities/190045
CVE: CVE-2020-4842
Published: 2020-12-21
Description: IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190046.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190046; https://www.ibm.com/support/pages/node/6336251; https://exchange.xforce.ibmcloud.com/vulnerabilities/190046
CVE: CVE-2020-4843
Published: 2020-12-21
Description: IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190048; https://www.ibm.com/support/pages/node/6250375; https://exchange.xforce.ibmcloud.com/vulnerabilities/190048
CVE: CVE-2020-4870
Published: 2020-12-21
Description: IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. IBM X-Force ID: 190833.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190833; https://www.ibm.com/support/pages/node/6380742; https://www.ibm.com/support/pages/node/6386466
CVE: CVE-2020-4988
Published: 2020-12-21
Description: Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of service or possibly execute code. IBM X-Force ID: 192706.
CVSS Score: 9.8 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192706; https://exchange.xforce.ibmcloud.com/vulnerabilities/192706
CVE: CVE-2020-5808
Published: 2020-12-21
Description: In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration.
CVSS Score: 7.5 (HIGH)
References: https://www.tenable.com/security/tns-2020-11; https://www.tenable.com/security/tns-2020-11
CVE: CVE-2020-6881
Published: 2020-12-21
Description: ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device to deny service. This affects:<ZXHN E8810, ZXHN E8820, ZXHN E8822><E8810 V1.0.26, E8810 V2.0.1, E8820 V1.1.3L, E8820 V2.0.13, E8822 V2.0.13>
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014202; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014202
CVE: CVE-2020-6882
Published: 2020-12-21
Description: ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specific topics. This affects:<ZXHN E8810, ZXHN E8820, ZXHN E8822><E8810 V1.0.26, E8810 V2.0.1, E8820 V1.1.3L, E8820 V2.0.13, E8822 V2.0.13>
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014202; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014202
CVE: CVE-2020-21377
Published: 2020-12-21
Description: SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/yunyecms/yunyecms/issues/I15J32?from=project-issue; https://gitee.com/yunyecms/yunyecms/issues/I15J32?from=project-issue
CVE: CVE-2020-21378
Published: 2020-12-21
Description: SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hackxf/cms_vul/blob/master/SeacmsSQL.md; https://github.com/hackxf/cms_vul/blob/master/SeacmsSQL.md
CVE: CVE-2020-35604
Published: 2020-12-21
Description: An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.mindpointgroup.com/blog/webta-xxe-version-5-0-4-vulnerability/; https://www.mindpointgroup.com/blog/webta-xxe-version-5-0-4-vulnerability/
CVE: CVE-2020-35605
Published: 2020-12-21
Description: The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/kovidgoyal/kitty/commit/82c137878c2b99100a3cdc1c0f0efea069313901; https://github.com/kovidgoyal/kitty/issues/3128; https://www.debian.org/security/2020/dsa-4819
CVE: CVE-2020-35606
Published: 2020-12-21
Description: Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/49318; https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html
CVE: CVE-2018-7580
Published: 2020-12-21
Description: Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of the hub's functionality will be unresponsive. The cloud service also won't work with the hub.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/160724/Philips-Hue-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2020/Dec/51; https://www.iliashn.com/CVE-2018-7580/
CVE: CVE-2020-11717
Published: 2020-12-21
Description: An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160628/Programi-Bilanc-Build-007-Release-014-31.01.2020-SQL-Injection.html; https://bilanc.com/en/; https://seclists.org/fulldisclosure/2020/Dec/36
CVE: CVE-2020-35151
Published: 2020-12-21
Description: The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/; https://www.exploit-db.com/exploits/49307; https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/
CVE: CVE-2020-26277
Published: 2020-12-21
Description: DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59
References: https://github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10; https://github.com/datacharmer/dbdeployer/security/advisories/GHSA-47wr-426j-fr82; https://github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10
CVE: CVE-2020-26281
Published: 2020-12-21
Description: async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. This has been addressed in async-h1 2.3.0 and previous versions have been yanked.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-444
References: https://github.com/http-rs/async-h1/releases/tag/v2.3.0; https://github.com/http-rs/async-h1/security/advisories/GHSA-4vr9-8cjf-vf9c; https://github.com/http-rs/async-h1/releases/tag/v2.3.0
CVE: CVE-2020-29596
Published: 2020-12-21
Description: MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://packetstormsecurity.com/files/160470/MiniWeb-HTTP-Server-0.8.19-Buffer-Overflow.html; https://securityforeveryone.com/blog/miniweb-http-server-vulnerability-0-day-cve-2020-29596; https://sourceforge.net/projects/miniweb/files/miniweb/0.8/
CVE: CVE-2020-8995
Published: 2020-12-21
Description: Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2020/Dec/38; https://packetstormsecurity.com/files/160626/Programi-Bilanc-Build-007-Release-014-31.01.2020-Hardcoded-Credentials.html; http://seclists.org/fulldisclosure/2020/Dec/38
CVE: CVE-2020-26284
Published: 2020-12-21
Description: Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround.
CVSS Score: 7.7 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq; https://github.com/golang/go/issues/38736; https://github.com/gohugoio/hugo/security/advisories/GHSA-8j34-9876-pvfq
CVE: CVE-2020-35622
Published: 2020-12-21
Description: An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page variable within the formatItem function was not being properly escaped, allowing for XSS under certain conditions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GlobalUsage/+/646744; https://phabricator.wikimedia.org/T268341; https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GlobalUsage/+/646744
CVE: CVE-2020-35623
Published: 2020-12-21
Description: An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-706
References: https://github.com/CWRUChielLab/CASAuth/pull/11; https://phabricator.wikimedia.org/T263498; https://github.com/CWRUChielLab/CASAuth/pull/11
CVE: CVE-2020-35624
Published: 2020-12-21
Description: An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide unintended clues about how a voting process unfolded.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://gerrit.wikimedia.org/r/q/If8e15eb8ce9ec652c06816cbff52bb084fd50e73; https://phabricator.wikimedia.org/T268794; https://gerrit.wikimedia.org/r/q/If8e15eb8ce9ec652c06816cbff52bb084fd50e73
CVE: CVE-2020-35625
Published: 2020-12-21
Description: An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://gerrit.wikimedia.org/r/q/Ic899a8b15bc510e61cdacb5c024af2d226a2dbeb; https://phabricator.wikimedia.org/T269718; https://gerrit.wikimedia.org/r/q/Ic899a8b15bc510e61cdacb5c024af2d226a2dbeb
CVE: CVE-2020-35626
Published: 2020-12-21
Description: An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gerrit.wikimedia.org/r/q/14dc79b1f44c2a1ca6b[PII_REDACTED]c7b8626fb57; https://phabricator.wikimedia.org/T268641; https://gerrit.wikimedia.org/r/q/14dc79b1f44c2a1ca6b[PII_REDACTED]c7b8626fb57
CVE: CVE-2020-28448
Published: 2020-12-22
Description: This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://github.com/evangelion1204/multi-ini/pull/37; https://snyk.io/vuln/SNYK-JS-MULTIINI-1048969; https://github.com/evangelion1204/multi-ini/pull/37
CVE: CVE-2020-28460
Published: 2020-12-22
Description: This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://github.com/evangelion1204/multi-ini/commit/6b2212b2ce152c19538a2431415f72942c5a1bde; https://snyk.io/vuln/SNYK-JS-MULTIINI-1053229; https://github.com/evangelion1204/multi-ini/commit/6b2212b2ce152c19538a2431415f72942c5a1bde