rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7695 HTTP Response Splitting
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Problem types: description: HTTP Response Splitting
Affected products: vendor: n/a
product: uvicorn
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Everardo Padilla Saca
Published: 2020-07-27T11:25:16.789Z
CVE-2020-7696 Information Exposure
This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: react-native-fast-image
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrei Alecu
Published: 2020-07-17T09:25:15.060Z
CVE-2020-7697 Command Injection
This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
Problem types: description: Command Injection
Affected products: vendor: n/a
product: mock2easy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-07-29T12:40:18.271Z
CVE-2020-7698 Command Injection
This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: Gerapy
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-07-29T12:40:12.518Z
CVE-2020-7699 Prototype Pollution
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: express-fileupload
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: po6ix
Published: 2020-07-30T09:05:14.105Z
CVE-2020-7700 Prototype Pollution
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: phpjs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-14T15:05:12.961Z
CVE-2020-7701 Prototype Pollution
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: madlib-object-utils
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-14T15:10:12.390Z
CVE-2020-7702 Prototype Pollution
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: Templ8
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-17T13:50:11.204Z
CVE-2020-7703 Prototype Pollution
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: nis-utils
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-17T14:50:11.753Z
CVE-2020-7704 Prototype Pollution
The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: linux-cmdline
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-17T16:20:12.454Z
CVE-2020-7705 Malicious Package
This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.
Problem types: description: Malicious Package
Affected products: vendor: n/a
product: MintegralAdSDK
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-08-24T17:15:15.656Z
CVE-2020-7706 Prototype Pollution
The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: connie-lang
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-18T09:20:12.686Z
CVE-2020-7707 Prototype Pollution
The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: property-expr
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-18T13:40:12.220Z
CVE-2020-7708 Prototype Pollution
The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: irrelon-path
vendor: n/a
product: @irrelon/path
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-08-18T14:35:12.630Z
CVE-2020-7709 Prototype Pollution
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: json-pointer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: posix
Published: 2020-10-05T07:50:14.736Z
CVE-2020-7710 Sandbox Escape
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
Problem types: description: Sandbox Escape
Affected products: vendor: n/a
product: safe-eval
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.7
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Anirudh Anand
Published: 2020-08-21T09:15:13.975Z
CVE-2020-7711 Denial of Service (DoS)
This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: github.com/russellhaering/goxmldsig
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
version: 3.1
Credits: lang: en
value: Steven Johnstone
Published: 2020-08-23T13:35:12.024Z
CVE-2020-7712 Command Injection
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: json
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: po6ix
Published: 2020-08-30T07:15:16.008Z
CVE-2020-7713 Prototype Pollution
All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: arr-flatten-unflatten
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:10:11.703Z
CVE-2020-7714 Prototype Pollution
All versions of package confucious are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: confucious
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:20:19.793Z
CVE-2020-7715 Prototype Pollution
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deep-get-set
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:20:15.805Z
CVE-2020-7716 Prototype Pollution
All versions of package deeps are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deeps
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:20:12.116Z
CVE-2020-7717 Prototype Pollution
All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: dot-notes
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:25:15.747Z
CVE-2020-7718 Prototype Pollution
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: gammautils
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:25:11.809Z
CVE-2020-7719 Prototype Pollution
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: locutus
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:30:14.672Z
CVE-2020-7720 Prototype Pollution
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: node-forge
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:35:12.869Z
CVE-2020-7721 Prototype Pollution
All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: node-oojs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:40:16.163Z
CVE-2020-7722 Prototype Pollution
All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: nodee-utils
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:40:12.396Z
CVE-2020-7723 Prototype Pollution
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: promisehelpers
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:45:17.168Z
CVE-2020-7724 Prototype Pollution
All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: tiny-conf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:45:13.481Z
CVE-2020-7725 Prototype Pollution
All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: worksmith
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:50:19.423Z