rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25765 
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:26:18.000Z
CVE-2021-25766 
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:28:37.000Z
CVE-2021-25767 
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:29:04.000Z
CVE-2021-25768 
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:29:50.000Z
CVE-2021-25769 
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:30:34.000Z
CVE-2021-25770 
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:31:27.000Z
CVE-2021-25771 
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:32:02.000Z
CVE-2021-25772 
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:33:26.000Z
CVE-2021-25773 
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:32:44.000Z
CVE-2021-25774 
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:34:55.000Z
CVE-2021-25775 
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:37:52.000Z
CVE-2021-25776 
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:34:16.000Z
CVE-2021-25777 
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:50:56.000Z
CVE-2021-25778 
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-03T15:50:21.000Z
CVE-2021-25779 
Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:32.000Z
CVE-2021-25780 
An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-17T14:32:39.000Z
CVE-2021-25783 
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T22:21:29.000Z
CVE-2021-25784 
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T22:21:30.000Z
CVE-2021-25785 
Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T22:21:31.000Z
CVE-2021-25786 
An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-25790 
Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T17:44:14.000Z
CVE-2021-25791 
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T17:44:16.000Z
CVE-2021-25801 
A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T16:26:55.000Z
CVE-2021-25802 
A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T16:26:57.000Z
CVE-2021-25803 
A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T16:26:58.000Z
CVE-2021-25804 
A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-26T16:26:59.000Z
CVE-2021-25808 
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T19:39:43.000Z
CVE-2021-25809 
UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-23T19:39:45.000Z
CVE-2021-25810 
Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T15:44:02.000Z
CVE-2021-25811 
MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T15:44:03.000Z
CVE-2021-25812 
Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T15:44:03.000Z
CVE-2021-25827 
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-28T00:00:00.000Z
CVE-2021-25828 
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-28T00:00:00.000Z
CVE-2021-25829 
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T15:07:19.000Z
CVE-2021-25830 
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T15:07:38.000Z
CVE-2021-25831 
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T15:08:37.000Z
CVE-2021-25832 
A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions on DocumentServer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T15:08:57.000Z
CVE-2021-25833 
A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code execution on DocumentServer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-01T15:09:17.000Z
CVE-2021-25834 
Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T17:53:46.000Z
CVE-2021-25835 
Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T17:57:19.000Z
CVE-2021-25836 
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memory(stateObject.code) and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contracts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T17:54:16.000Z
CVE-2021-25837 
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T17:54:37.000Z
CVE-2021-25838 
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-26T13:30:38.000Z
CVE-2021-25839 
A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-26T13:30:43.000Z
CVE-2021-25845 
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T10:52:19.000Z
CVE-2021-25846 
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T10:52:25.000Z
CVE-2021-25847 
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T10:43:02.000Z
CVE-2021-25848 
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T10:42:55.000Z
CVE-2021-25849 
An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-10T10:52:33.000Z
CVE-2021-25856 
An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-25857 
An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-11T00:00:00.000Z
CVE-2021-25863 
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T07:05:27.000Z
CVE-2021-25864 
node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-26T07:09:07.000Z
CVE-2021-25874 
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:32:48.000Z
CVE-2021-25875 
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:32:57.000Z
CVE-2021-25876 
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:33:10.000Z
CVE-2021-25877 
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:33:18.000Z
CVE-2021-25878 
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-01T11:33:25.000Z
CVE-2021-25893 
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T11:31:08.000Z
CVE-2021-25894 
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T11:31:15.000Z
CVE-2021-25898 
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-23T20:47:25.000Z
CVE-2021-25899 
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-23T20:49:37.000Z
CVE-2021-25900 
An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:03:36.000Z
CVE-2021-25901 
An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:03:24.000Z
CVE-2021-25902 
An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:03:11.000Z
CVE-2021-25903 
An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:59.000Z
CVE-2021-25904 
An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:48.000Z
CVE-2021-25905 
An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:39.000Z
CVE-2021-25906 
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:30.000Z
CVE-2021-25907 
An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} double drop can be performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:19.000Z
CVE-2021-25908 
An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-22T09:02:02.000Z
CVE-2021-25909 ZIV AUTOMATION 4CCT Denial of Service vulnerability
ZIV Automation 4CCT-EA6-334126BF firmware version 3.23.80.27.36371, allows an unauthenticated, remote attacker to cause a denial of service condition on the device. An attacker could exploit this vulnerability by sending specific packets to the port 7919.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: ZIV AUTOMATION
product: 4CCT-EA6-334126BF
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Industrial Cybersecurity team of S21Sec, special mention to Aarón Flecha Menéndez
Published: 2021-01-29T13:24:37.269Z
CVE-2021-25910 ZIV AUTOMATION 4CCT vulnerable to improper authentication
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: ZIV AUTOMATION
product: 4CCT-EA6-334126BF
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Industrial Cybersecurity team of S21Sec, special mention to Aarón Flecha Menéndez
Published: 2021-01-29T13:22:29.031Z
CVE-2021-25912 
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: dotty
Published: 2021-02-02T18:40:37.000Z
CVE-2021-25913 
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: set-or-get
Published: 2021-02-08T21:22:45.000Z