rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7595 
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T22:54:14.000Z
CVE-2020-7596 
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: codecov npm module
Published: 2020-01-25T18:08:41.000Z
CVE-2020-7597 
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: codecov npm module
Published: 2020-02-17T18:48:40.000Z
CVE-2020-7598 
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: minimist
Published: 2020-03-11T21:40:09.000Z
CVE-2020-7599 
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.
Problem types: description: Insertion of Sensitive Information into Log File
Affected products: vendor: n/a
product: com.gradle.plugin-publish
Published: 2020-03-30T18:20:45.000Z
CVE-2020-7600 
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: querymen
Published: 2020-03-12T22:25:43.000Z
CVE-2020-7601 
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: gulp-scss-lint
Published: 2020-03-15T21:23:11.000Z
CVE-2020-7602 
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is used to construct the argument of function "execSync()", which can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: node-prompt-here
Published: 2020-03-15T21:26:22.000Z
CVE-2020-7603 
closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: closure-compiler-stream
Published: 2020-03-15T21:48:52.000Z
CVE-2020-7604 
pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: pulverizr
Published: 2020-03-15T21:28:34.000Z
CVE-2020-7605 
gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: gulp-tape
Published: 2020-03-15T21:36:33.000Z
CVE-2020-7606 
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: docker-compose-remote-api
Published: 2020-03-15T21:31:11.000Z
CVE-2020-7607 
gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: gulp-styledocco
Published: 2020-03-15T21:40:50.000Z
CVE-2020-7608 
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: yargs-parser
Published: 2020-03-16T19:49:49.000Z
CVE-2020-7609 
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: node-rules
Published: 2020-04-27T21:06:35.000Z
CVE-2020-7610 
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Problem types: description: Deserialization of Untrusted Data
Affected products: vendor: n/a
product: bson
Published: 2020-03-30T18:28:17.000Z
CVE-2020-7611 
All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
Problem types: description: HTTP Request Header Injection
Affected products: vendor: n/a
product: io.micronaut:micronaut-http-client
Published: 2020-03-30T21:53:05.000Z
CVE-2020-7613 
clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: clamscan
Published: 2020-04-07T13:19:05.000Z
CVE-2020-7614 
npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: npm-programmatic
Published: 2020-04-07T13:21:05.000Z
CVE-2020-7615 
fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: fsa
Published: 2020-04-07T13:14:04.000Z
CVE-2020-7616 
express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: express-mock-middleware
Published: 2020-04-07T13:16:20.000Z
CVE-2020-7617 Prototype Pollution
ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.
Problem types: description: Prototype Pollution
Affected products: vendor: rawiroaisen
product: ini-parser
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-04-02T18:00:16.000Z
CVE-2020-7618 
sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: sds
Published: 2020-04-07T13:22:49.000Z
CVE-2020-7619 
get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: get-git-data
Published: 2020-04-02T20:43:32.000Z
CVE-2020-7620 
pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: pomelo-monitor
Published: 2020-04-02T20:38:52.000Z
CVE-2020-7621 
strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: strong-nginx-controller
Published: 2020-04-02T20:49:06.000Z
CVE-2020-7622 HTTP Response Splitting
This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
Problem types: description: HTTP Response Splitting
Affected products: vendor: n/a
product: io.jooby:jooby-netty
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Jonathan Leitschuh
Published: 2020-04-06T14:08:48.593Z
CVE-2020-7623 
jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: jscover
Published: 2020-04-02T20:55:19.000Z
CVE-2020-7624 
effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: effect
Published: 2020-04-02T21:03:16.000Z
CVE-2020-7625 
op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: op-browser
Published: 2020-04-02T21:19:57.000Z
CVE-2020-7626 
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: karma-mojo
Published: 2020-04-02T21:23:34.000Z
CVE-2020-7627 
node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: node-key-sender
Published: 2020-04-02T21:28:11.000Z
CVE-2020-7628 
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: install-package
Published: 2020-04-02T21:33:25.000Z
CVE-2020-7629 
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: install-package
Published: 2020-04-02T21:38:31.000Z
CVE-2020-7630 
git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: git-add-remote
Published: 2020-04-02T21:41:17.000Z
CVE-2020-7631 
diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: diskusage-ng
Published: 2020-04-06T12:18:39.000Z
CVE-2020-7632 
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: node-mpv
Published: 2020-04-06T12:21:43.000Z
CVE-2020-7633 
apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: apiconnect-cli-plugins
Published: 2020-04-06T12:24:12.000Z
CVE-2020-7634 
heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: heroku-addonpool
Published: 2020-04-06T12:27:11.000Z
CVE-2020-7635 
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: compass-compile
Published: 2020-04-06T12:29:26.000Z
CVE-2020-7636 
adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: adb-driver
Published: 2020-04-06T12:32:04.000Z
CVE-2020-7637 
class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: class-transformer
Published: 2020-04-06T12:34:54.000Z
CVE-2020-7638 
confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: confinit
Published: 2020-04-06T12:38:22.000Z
CVE-2020-7639 
eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: @eivifj/dot
Published: 2020-04-06T12:48:14.000Z
CVE-2020-7640 
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: pixl-class
Published: 2020-04-27T21:34:45.000Z
CVE-2020-7641 Prototype Pollution
This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: grunt-util-property
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 3.8
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-17T08:40:09.666Z
CVE-2020-7642 
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: lazysizes
Published: 2020-04-22T15:13:51.000Z
CVE-2020-7643 
paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: paypal-adaptive
Published: 2020-04-23T13:23:27.000Z
CVE-2020-7644 
fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: fun-map
Published: 2020-04-28T18:27:45.000Z
CVE-2020-7645 
All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: chrome-launcher
Published: 2020-05-02T15:25:12.000Z
CVE-2020-7646 
curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: curlrequest
Published: 2020-05-07T16:34:39.000Z
CVE-2020-7647 
All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: io.jooby:jooby and org.jooby:jooby
Published: 2020-05-11T19:30:18.000Z
CVE-2020-7648 
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T21:06:49.000Z
CVE-2020-7649 Directory Traversal
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: snyk-broker
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: Wing Chan of The Hut Group
Published: 2022-07-25T14:07:24.823Z
CVE-2020-7650 
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T21:11:39.000Z
CVE-2020-7651 
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T20:53:29.000Z
CVE-2020-7652 
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T20:46:35.000Z
CVE-2020-7653 
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
Problem types: description: Arbitrary File Read
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T20:40:22.000Z
CVE-2020-7654 
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: snyk-broker
Published: 2020-05-29T21:09:15.000Z
CVE-2020-7655 
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: n/a
product: netius
Published: 2020-05-21T14:15:54.000Z
CVE-2020-7656 
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Problem types: description: Cross-site Scripting
Affected products: vendor: n/a
product: jquery
Published: 2020-05-19T00:00:00.000Z
CVE-2020-7658 
meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: n/a
product: meinheld
Published: 2020-05-22T15:48:43.000Z
CVE-2020-7659 
reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more.
Problem types: description: HTTP Request Smuggling
Affected products: vendor: n/a
product: reel
Published: 2020-06-01T12:50:27.000Z
CVE-2020-7660 
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Problem types: description: Arbitrary Code Injection
Affected products: vendor: n/a
product: serialize-javascript
Published: 2020-06-01T14:50:55.000Z
CVE-2020-7661 
all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
Problem types: description: Regular Expression Denial of Service
Affected products: vendor: n/a
product: url-regex
Published: 2020-06-04T17:15:32.000Z