deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7731
Published: 2021-04-30
Description: This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/russellhaering/gosaml2/issues/59; https://github.com/russellhaering/gosaml2/releases/tag/v0.7.0; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOSAML2-608302
CVE: CVE-2021-20515
Published: 2021-04-30
Description: IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged user could overflow a buffer and execute arbitrary code on the system or cause a denial of service condition. IBM X-Force ID: 198366.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/198366; https://www.ibm.com/support/pages/node/6448568; https://exchange.xforce.ibmcloud.com/vulnerabilities/198366
CVE: CVE-2021-21534
Published: 2021-04-30
Description: Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to gain access to sensitive information via the local API.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21535
Published: 2021-04-30
Description: Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to gain root level access to the system.
CVSS Score: 7.4 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21536
Published: 2021-04-30
Description: Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to register the client to a server in order to view sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-21537
Published: 2021-04-30
Description: Dell Hybrid Client versions prior to 1.5 contain an information exposure vulnerability. A local unauthenticated attacker may exploit this vulnerability in order to view and exfiltrate sensitive information on the system.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000184667/dsa-2021-071-dell-hybrid-client-security-update-for-multiple-vulnerabilities
CVE: CVE-2021-29486
Published: 2021-04-30
Description: cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite-loop. In the case of a nodejs server-app using this library to act on invalid non-numeric data, the nodejs server may crash. This may affect other users of this server and/or require the server to be rebooted for proper operation. In the case of a browser app using this library to act on invalid non-numeric data, that browser may crash or lock up. A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function of input data. Although the documentation explains that numeric data is required, some users may confuse an array of strings like ["1","2","3","4","5"] for numeric data [1,2,3,4,5] when it is in fact string data. An infinite loop is possible when the cumulative-distribution-function is evaluated for a given point when the input data is string data rather than type `number`. This vulnerability enables an infinite-cpu-loop denial-of-service-attack on any app using npm:cumulative-distribution-function v1.0.3 or earlier if the attacker can supply malformed data to the library. The vulnerability could also manifest if a data source to be analyzed changes data type from Arrays of number (proper) to Arrays of string (invalid, but undetected by earlier version of the library). Users should upgrade to at least v2.0.0, or the latest version. Tests for several types of invalid data have been created, and version 2.0.0 has been tested to reject this invalid data by throwing a `TypeError()` instead of processing it. Developers using this library may wish to adjust their app's code slightly to better tolerate or handle this TypeError. Apps performing proper numeric data validation before sending data to this library should be mostly unaffected by this patch. The vulnerability can be mitigated in older versions by ensuring that only finite numeric data of type `Array[number]` or `number` is passed to `cumulative-distribution-function` and its `f(x)` function, respectively.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-835, CWE-20
References: https://github.com/DrPaulBrewer/cumulative-distribution-function/issues/7; https://github.com/DrPaulBrewer/cumulative-distribution-function/pull/8; https://github.com/DrPaulBrewer/cumulative-distribution-function/security/advisories/GHSA-58qp-5328-v7mh
CVE: CVE-2021-29463
Published: 2021-04-30
Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/Exiv2/exiv2/commit/783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b; https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3HKXR6JOVKMBE4HY4FDXNVZGNCQG6T3/
CVE: CVE-2021-29464
Published: 2021-04-30
Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-787
References: https://github.com/Exiv2/exiv2/commit/f[PII_REDACTED]aca5e68a65194f151a1de92398f54; https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3HKXR6JOVKMBE4HY4FDXNVZGNCQG6T3/
CVE: CVE-2021-31926
Published: 2021-04-30
Description: AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system's network configuration).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/CubeCoders/AMP/issues/443; https://github.com/CubeCoders/AMP/issues/443
CVE: CVE-2020-18084
Published: 2021-04-30
Description: Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yzmcms/yzmcms/issues/9; https://github.com/yzmcms/yzmcms/issues/9
CVE: CVE-2021-21227
Published: 2021-04-30
Description: Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1199345; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21228
Published: 2021-04-30
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 90.0.4430.93 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1139156; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21229
Published: 2021-04-30
Description: Incorrect security UI in downloads in Google Chrome on Android prior to 90.0.4430.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1198165; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21230
Published: 2021-04-30
Description: Type confusion in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1198705; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21231
Published: 2021-04-30
Description: Insufficient data validation in V8 in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1198696; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21232
Published: 2021-04-30
Description: Use after free in Dev Tools in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1175058; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21233
Published: 2021-04-30
Description: Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html; https://crbug.com/1182937; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
CVE: CVE-2021-21507
Published: 2021-04-30
Description: Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-261, CWE-326
References: https://www.dell.com/support/kbdoc/000185252; https://www.dell.com/support/kbdoc/000185252
CVE: CVE-2021-21530
Published: 2021-04-30
Description: Dell OpenManage Enterprise-Modular (OME-M) versions prior to 1.30.00 contain a security bypass vulnerability. An authenticated malicious user with low privileges may potentially exploit the vulnerability to escape from the restricted environment and gain access to sensitive information in the system, resulting in information disclosure and elevation of privilege.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/000185205; https://www.dell.com/support/kbdoc/000185205
CVE: CVE-2021-21531
Published: 2021-04-30
Description: Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-602, CWE-669
References: https://www.dell.com/support/kbdoc/000184565; https://www.dell.com/support/kbdoc/000184565
CVE: CVE-2021-21539
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21540
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21541
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21542
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21543
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21544
Published: 2021-04-30
Description: Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
CVSS Score: 2.7 (LOW)
CWE: CWE-602, CWE-287
References: https://www.dell.com/support/kbdoc/000185293; https://www.dell.com/support/kbdoc/000185293
CVE: CVE-2021-21547
Published: 2021-04-30
Description: Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Utility is run on the system. The credentials of the Unisphere Administrator are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-312
References: https://www.dell.com/support/kbdoc/000185484; https://www.dell.com/support/kbdoc/000185484
CVE: CVE-2021-31933
Published: 2021-04-30
Description: A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-706
References: http://packetstormsecurity.com/files/162572/Chamilo-LMS-1.11.14-Remote-Code-Execution.html; https://github.com/chamilo/chamilo-lms/commit/229302139e8d23bf6862183cf219b967f6e2fbc1; https://github.com/chamilo/chamilo-lms/commit/f65d065061a77bb2e84f73217079ce3998cf3453
CVE: CVE-2020-28943
Published: 2021-04-30
Description: OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE: CVE-2020-28944
Published: 2021-04-30
Description: OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html; https://open-xchange.com; http://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE: CVE-2021-31792
Published: 2021-04-30
Description: XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://chris-forbes.github.io/CVE-2021-31792; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19; https://github.com/salesagility/SuiteCRM
CVE: CVE-2021-31934
Published: 2021-04-30
Description: OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE: CVE-2021-31935
Published: 2021-04-30
Description: OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/162406/OX-App-Suite-OX-Guard-SSRF-DoS-Cross-Site-Scripting.html
CVE: CVE-2021-28359
Published: 2021-05-02
Description: The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df[PII_REDACTED]8d99432%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2021-31996
Published: 2021-05-03
Description: An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::merge().
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://rustsec.org/advisories/RUSTSEC-2021-0053.html; https://rustsec.org/advisories/RUSTSEC-2021-0053.html
CVE: CVE-2021-25631
Published: 2021-05-03
Description: In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-184
References: https://positive.security/blog/url-open-rce#open-libreoffice; https://www.libreoffice.org/about-us/security/advisories/cve-2021-25631/; https://positive.security/blog/url-open-rce#open-libreoffice
CVE: CVE-2021-28860
Published: 2021-05-03
Description: In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1321
References: http://nodejs.com; https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028; https://github.com/adaltas/node-mixme/issues/1