deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24271
Published: 2021-02-01
Description: A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/users/yohoho221/projects/1; https://github.com/users/yohoho221/projects/1
CVE: CVE-2021-21266
Published: 2021-02-01
Description: openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from the file system. Responses to SSDP requests can be especially malicious. All add-ons that use SAX or JAXB parsing of externally received XML are potentially subject to this kind of attack. In openHAB, the following add-ons are potentially impacted: AvmFritz, BoseSoundtouch, DenonMarantz, DLinkSmarthome, Enigma2, FmiWeather, FSInternetRadio, Gce, Homematic, HPPrinter, IHC, Insteon, Onkyo, Roku, SamsungTV, Sonos, Roku, Tellstick, TR064, UPnPControl, Vitotronic, Wemo, YamahaReceiver and XPath Tranformation. The vulnerabilities have been fixed in versions 2.5.12 and 3.0.1 by a more strict configuration of the used XML parser.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-611
References: https://dev.to/brianverm/configure-your-java-xml-parsers-to-prevent-xxe-213c; https://github.com/openhab/openhab-addons/commit/81935b0ab126e6d9aebd2f6c3fc67d82bb7e8b86; https://github.com/openhab/openhab-addons/security/advisories/GHSA-r2hc-pmr7-4c9r
CVE: CVE-2021-21276
Published: 2021-02-01
Description: Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a request with specific cookie headers to the /setup/finish endpoint, they may be able to obtain admin privileges on the instance. This is caused by a loose comparison (==) in SetupController that is susceptible to attack. The project has been patched to ensure that a strict comparison (===) is used to verify the setup key, and that /setup/finish verifies that no users table exists before performing any migrations or provisioning any new accounts. This is fixed in version 2.3.0. Users can patch this vulnerability without upgrading by adding abort(404) to the very first line of finishSetup in SetupController.php.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-863
References: http://packetstormsecurity.com/files/171743/POLR-URL-2.3.0-Shortener-Admin-Takeover.html; https://github.com/cydrobolt/polr/commit/b[PII_REDACTED]caf6069b4a29dad3b6739c322c675; https://github.com/cydrobolt/polr/releases/tag/2.3.0
CVE: CVE-2021-21277
Published: 2021-02-01
Description: angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledInput)" where "userControlledInput" is text that comes from user input. The security of the package could be bypassed by using a more complex payload, using a ".constructor.constructor" technique. In terms of impact: If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution. This is fixed in version 1.1.2 of angular-expressions A temporary workaround might be either to disable user-controlled input that will be fed into angular-expressions in your application or allow only following characters in the userControlledInput.
CVSS Score: 8.5 (HIGH)
CWE: CWE-74, CWE-94
References: http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html; https://github.com/peerigon/angular-expressions/commit/07edb62902b1f6127b3dcc013da61c6316dd0bf1; https://github.com/peerigon/angular-expressions/security/advisories/GHSA-j6px-jwvv-vpwq
CVE: CVE-2021-23330
Published: 2021-02-01
Description: All versions of package launchpad are vulnerable to Command Injection via stop.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/bitovi/launchpad/issues/123%23issuecomment-732188118; https://github.com/bitovi/launchpad/pull/124; https://snyk.io/vuln/SNYK-JS-LAUNCHPAD-1044065
CVE: CVE-2020-13562
Published: 2021-02-01
Description: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177
CVE: CVE-2020-13563
Published: 2021-02-01
Description: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177
CVE: CVE-2020-13564
Published: 2021-02-01
Description: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177
CVE: CVE-2020-25594
Published: 2021-02-01
Description: HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
CVSS Score: 5.3 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336
CVE: CVE-2020-28426
Published: 2021-02-01
Description: All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-KILLPROCESSONPORT-1055458; https://snyk.io/vuln/SNYK-JS-KILLPROCESSONPORT-1055458
CVE: CVE-2021-21286
Published: 2021-02-01
Description: AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.
CVSS Score: 7.7 (HIGH)
CWE: CWE-863
References: https://avideo.tube/; https://github.com/WWBN/AVideo/security/advisories/GHSA-xq8j-fhg5-hr39; https://avideo.tube/
CVE: CVE-2021-3024
Published: 2021-02-01
Description: HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
CVSS Score: 5.3 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
CVE: CVE-2021-3282
Published: 2021-02-01
Description: HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337; https://security.gentoo.org/glsa/202207-01; https://discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337
CVE: CVE-2021-3283
Published: 2021-02-01
Description: HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
CVSS Score: 7.5 (HIGH)
References: https://discuss.hashicorp.com/t/hcsec-2021-01-nomad-s-exec-and-java-task-drivers-did-not-isolate-processes/20332; https://discuss.hashicorp.com/t/hcsec-2021-01-nomad-s-exec-and-java-task-drivers-did-not-isolate-processes/20332
CVE: CVE-2020-20287
Published: 2021-02-01
Description: Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.yccms.net/; https://blog.jiguang.xyz/posts/remote-code-execution-via-upload-image/; http://www.yccms.net/
CVE: CVE-2020-20289
Published: 2021-02-01
Description: Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.yccms.net/; https://blog.jiguang.xyz/posts/yccms-sql-injection/; http://www.yccms.net/
CVE: CVE-2020-20290
Published: 2021-02-01
Description: Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.jiguang.xyz/posts/yccms-directory-traversal-vulnerability-report/; https://blog.jiguang.xyz/posts/yccms-directory-traversal-vulnerability-report/
CVE: CVE-2020-20294
Published: 2021-02-01
Description: An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/arterli/CmsWing/issues/49; https://github.com/arterli/CmsWing/issues/49
CVE: CVE-2020-20295
Published: 2021-02-01
Description: An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/arterli/CmsWing/issues/50; https://github.com/arterli/CmsWing/issues/50
CVE: CVE-2020-20296
Published: 2021-02-01
Description: An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/arterli/CmsWing/issues/51; https://github.com/arterli/CmsWing/issues/51
CVE: CVE-2020-21176
Published: 2021-02-01
Description: SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.jiguang.xyz/posts/thinkjs-sql-injection/; https://github.com/thinkjs/thinkjs; https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
CVE: CVE-2020-21179
Published: 2021-02-01
Description: Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wclimb/Koa2-blog/issues/40; https://github.com/wclimb/Koa2-blog/issues/40
CVE: CVE-2020-21180
Published: 2021-02-01
Description: Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wclimb/Koa2-blog/issues/41; https://github.com/wclimb/Koa2-blog/issues/41
CVE: CVE-2021-21287
Published: 2021-02-01
Description: MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-30T00-20-58Z there is a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.). In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed. This is fixed in version RELEASE.2021-01-30T00-20-58Z, all users are advised to upgrade. As a workaround you can disable the browser front-end with "MINIO_BROWSER=off" environment variable.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://github.com/minio/minio/commit/eb6871ecd960d570f[PII_REDACTED]9e6db181bf276; https://github.com/minio/minio/pull/11337; https://github.com/minio/minio/releases/tag/RELEASE.2021-01-30T00-20-58Z
CVE: CVE-2020-28493
Published: 2021-02-01
Description: This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20; https://github.com/pallets/jinja/pull/1343; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/
CVE: CVE-2019-20468
Published: 2021-02-01
Description: An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/; https://www.tk-star.com
CVE: CVE-2019-20470
Published: 2021-02-01
Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up a voice communication channel from the watch to any telephone number, initiated by sending a specific SMS and using the default password, e.g., pw,<password>,call,<mobile_number> triggers an outbound call from the watch. The password is sometimes available because of CVE-2019-20471.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188, CWE-284
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/; https://www.tk-star.com
CVE: CVE-2019-20471
Published: 2021-02-01
Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) for administrative purposes. There is no prompt to change this password. Note that this password can be used in combination with CVE-2019-20470.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/; https://www.tk-star.com
CVE: CVE-2019-20473
Published: 2021-02-01
Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Jul/14; https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/; https://www.tk-star.com
CVE: CVE-2021-3340
Published: 2021-02-01
Description: A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/wikindx/news/2021/01/wikindx-v641-released/; https://sourceforge.net/projects/wikindx/; https://sourceforge.net/p/wikindx/news/2021/01/wikindx-v641-released/
CVE: CVE-2021-3378
Published: 2021-02-01
Description: FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/161601/FortiLogger-4.4.2.2-Arbitrary-File-Upload.html; http://packetstormsecurity.com/files/161974/FortiLogger-Arbitrary-File-Upload.html; https://github.com/erberkan/fortilogger_arbitrary_fileupload
CVE: CVE-2020-14192
Published: 2021-02-02
Description: Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jira.atlassian.com/browse/CRUC-8502; https://jira.atlassian.com/browse/FE-7334; https://jira.atlassian.com/browse/CRUC-8502
CVE: CVE-2020-36231
Published: 2021-02-02
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://jira.atlassian.com/browse/JRASERVER-72002; https://jira.atlassian.com/browse/JRASERVER-72002
CVE: CVE-2020-25037
Published: 2021-02-02
Description: UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.
CVSS Score: 8.2 (HIGH)
CWE: CWE-434
References: https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/; https://ucopia.com/en/solutions/product-line-wifi/; https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/
CVE: CVE-2020-25035
Published: 2021-02-02
Description: UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE-2017-11322.
CVSS Score: 6.7 (MEDIUM)
References: https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/; https://ucopia.com/en/solutions/product-line-wifi/; https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/
CVE: CVE-2020-25036
Published: 2021-02-02
Description: UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell with admin user rights, via an unprotected less command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/; https://ucopia.com/en/solutions/product-line-wifi/; https://blog.globadis.com/blog/ucopia-v6-multiple-cves-root/
CVE: CVE-2020-1896
Published: 2021-02-02
Description: A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2; https://www.facebook.com/security/advisories/cve-2020-1896; https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2
CVE: CVE-2020-24335
Published: 2021-02-02
Description: An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory with crafted DNS packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/adamdunkels/uip; https://github.com/contiki-ng/contiki-ng; https://github.com/contiki-os/contiki
CVE: CVE-2021-20207
Published: 2021-02-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:CVE-2021-3348. Reason: This candidate is a reservation duplicate of CVE-2021-3348. Notes: All CVE users should reference CVE-2021-3348 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-3281
Published: 2021-02-02
Description: In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://docs.djangoproject.com/en/3.1/releases/security/; https://groups.google.com/forum/#%21forum/django-announce; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
CVE: CVE-2020-28494
Published: 2021-02-02
Description: This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5; https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672; https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5
CVE: CVE-2020-28495
Published: 2021-02-02
Description: This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
CVSS Score: 7.3 (HIGH)
References: https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set; https://github.com/totaljs/framework/blob/master/utils.js%23L6606; https://github.com/totaljs/framework/blob/master/utils.js%23L6617