rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7662 
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: websocket-extensions (npm)
Published: 2020-06-02T18:28:46.000Z
CVE-2020-7663 
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: websocket-extensions (ruby)
Published: 2020-06-02T18:25:01.000Z
CVE-2020-7664 Arbitrary File Write via Archive Extraction (Zip Slip)
In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/unknwon/cae/zip
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-06-17T16:00:17.220Z
CVE-2020-7665 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/u-root/u-root/pkg/uzip
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-09-01T13:55:13.737Z
CVE-2020-7666 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/u-root/u-root/pkg/cpio
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-09-01T13:55:17.641Z
CVE-2020-7667 Arbitrary File Write via Archive Extraction (Zip Slip)
In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/sassoftware/go-rpmutils/cpio
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-06-24T12:00:15.519Z
CVE-2020-7668 Arbitrary File Write via Archive Extraction (Zip Slip)
In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/unknwon/cae/tz
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-06-17T16:00:21.626Z
CVE-2020-7669 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: github.com/u-root/u-root/pkg/tarutil
Credits: lang: en
value: Georgios Gkitsas of Snyk Security Team
Published: 2020-09-01T13:55:21.545Z
CVE-2020-7670 
agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: n/a
product: agoo
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7671 
goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: n/a
product: goliath
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7672 
mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: mosc
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7673 
node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: node-extend
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7674 
access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: access-policy
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7675 
cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: cd-messenger
Published: 2020-06-10T15:36:01.000Z
CVE-2020-7676 
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Problem types: description: Cross-site Scripting
Affected products: vendor: n/a
product: angular.js
Published: 2020-06-08T13:34:09.000Z
CVE-2020-7677 Arbitrary Code Execution
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: thenify
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
baseScore: 8.6
temporalScore: 8.1
baseSeverity: HIGH
temporalSeverity: HIGH
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:08:22.131Z
CVE-2020-7678 Arbitrary Code Execution
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: node-import
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:07:56.881Z
CVE-2020-7679 Prototype Pollution
In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: casperjs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Published: 2020-06-19T10:40:12.622Z
CVE-2020-7680 
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: docsify
Published: 2020-07-20T15:22:13.000Z
CVE-2020-7681 Directory Traversal
This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: marscode
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-25T08:35:19.851Z
CVE-2020-7682 Directory Traversal
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: marked-tree
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-25T08:35:15.733Z
CVE-2020-7683 Directory Traversal
This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: rollup-plugin-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-25T08:35:11.561Z
CVE-2020-7684 Directory Traversal
This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: rollup-plugin-serve
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-17T07:25:11.671Z
CVE-2020-7685 Insecure Defaults
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Problem types: description: Insecure Defaults
Affected products: vendor: n/a
product: UmbracoForms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Adrian Gigliotti from Shearwater Solutions
Published: 2020-07-28T16:25:15.127Z
CVE-2020-7686 Directory Traversal
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: rollup-plugin-dev-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-25T08:40:12.726Z
CVE-2020-7687 Directory Traversal
This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: fast-http
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-07-25T08:40:16.391Z
CVE-2020-7688 Command Injection
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: mversion
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: REASONABLE
scope: UNCHANGED
temporalScore: 7.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R
version: 3.1
Credits: lang: en
value: Habib Ullah
Published: 2020-07-01T16:15:15.509Z
CVE-2020-7689 Insecure Encryption
Data is truncated wrong when its length is greater than 255 bytes.
Problem types: description: Insecure Encryption
Affected products: vendor: n/a
product: bcrypt
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: pool683
Published: 2020-07-01T13:55:14.313Z
CVE-2020-7690 
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: jspdf
Published: 2020-07-06T12:25:21.000Z
CVE-2020-7691 Cross-site Scripting (XSS)
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: jspdf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.7
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-07-06T12:25:16.033Z
CVE-2020-7692 Improper Authorization
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Problem types: description: Improper Authorization
Affected products: vendor: n/a
product: com.google.oauth-client:google-oauth-client
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Stefán Freyr Stefánsson
Published: 2020-07-09T13:20:16.446Z
CVE-2020-7693 Denial of Service (DoS)
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: sockjs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 4.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O
version: 3.1
Credits: lang: en
value: Andrew Snow
Published: 2020-07-09T13:20:24.056Z
CVE-2020-7694 Log Injection
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Problem types: description: Log Injection
Affected products: vendor: n/a
product: uvicorn
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 3.5
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Everardo Padilla Saca
Published: 2020-07-27T11:25:12.371Z