rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-28421 
CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackers to elevate privileges.
Problem types: description: Local Privilege Elevation
Affected products: vendor: n/a
product: CA Unified Infrastructure Management
Published: 2020-11-23T15:43:25.000Z
CVE-2020-28422 Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: git-archive
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: TEMPORARY_FIX
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 6.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L/RL:T
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:06:16.156Z
CVE-2020-28423 Command Injection
This affects all versions of package monorepo-build.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: monorepo-build
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:28:02.942Z
CVE-2020-28424 Command Injection
This affects all versions of package s3-kilatstorage.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: s3-kilatstorage
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 6.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:27:51.364Z
CVE-2020-28425 Command Injection
This affects all versions of package curljs.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: curljs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:27:33.975Z
CVE-2020-28426 Command Injection
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: kill-process-on-port
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2021-02-01T15:30:15.549Z
CVE-2020-28429 Command Injection
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
Problem types: description: Command Injection
Affected products: vendor: n/a
product: geojson2kml
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2021-02-23T15:10:14.491Z
CVE-2020-28433 Command Injection
This affects all versions of package node-latex-pdf.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: node-latex-pdf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:27:18.522Z
CVE-2020-28434 Command Injection
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: gitblame
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:26:12.228Z
CVE-2020-28435 Command Injection
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: ffmpeg-sdk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:10:26.870Z
CVE-2020-28436 Command Injection
This affects all versions of package google-cloudstorage-commands.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: google-cloudstorage-commands
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:09:01.135Z
CVE-2020-28437 Command Injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: heroku-env
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:25:58.412Z
CVE-2020-28438 Command Injection
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
Problem types: description: Command Injection
Affected products: vendor: n/a
product: deferred-exec
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:05:56.863Z
CVE-2020-28439 Command Injection
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:
Problem types: description: Command Injection
Affected products: vendor: n/a
product: corenlp-js-prefab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-12-11T16:55:21.069Z
CVE-2020-28440 Command Injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: corenlp-js-interface
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2020-12-11T16:55:17.072Z
CVE-2020-28441 Prototype Pollution
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: conf-cfg-ini
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: Eugene Lim
lang: en
value: Government Technology Agency Cyber Security Group
Published: 2022-07-25T14:06:32.324Z
CVE-2020-28442 Prototype Pollution
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: js-data
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Alessio Della Libera (d3lla)
Published: 2020-12-15T07:25:15.395Z
CVE-2020-28443 Command Injection
This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: sonar-wrapper
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:05:10.581Z
CVE-2020-28445 Command Injection
This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: npm-help
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:10:11.158Z
CVE-2020-28446 Command Injection
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: ntesseract
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:05:28.210Z
CVE-2020-28447 Command Injection
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
Problem types: description: Command Injection
Affected products: vendor: n/a
product: xopen
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-07-25T14:11:23.108Z
CVE-2020-28448 Prototype Pollution
This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: multi-ini
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: REASONABLE
scope: UNCHANGED
temporalScore: 4.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R
version: 3.1
Credits: lang: en
value: Eugene Lim
lang: en
value: Government Technology Agency Cyber Security Group
Published: 2020-12-22T13:05:19.967Z
CVE-2020-28449 Prototype Pollution
This affects all versions of package decal. The vulnerability is in the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: decal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Nikita Stupin
Published: 2021-02-04T14:40:22.464Z
CVE-2020-28450 Prototype Pollution
This affects all versions of package decal. The vulnerability is in the extend function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: decal
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Nikita Stupin
Published: 2021-02-04T14:40:16.022Z
CVE-2020-28451 Command Injection
This affects the package image-tiler before 2.0.2.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: image-tiler
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:25:47.528Z
CVE-2020-28452 Cross-site Request Forgery (CSRF)
This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty.
Problem types: description: Cross-site Request Forgery (CSRF)
Affected products: vendor: n/a
product: com.softwaremill.akka-http-session:core_2.12
vendor: n/a
product: com.softwaremill.akka-http-session:core_2.11
vendor: n/a
product: com.softwaremill.akka-http-session:core_2.13
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Willem Vermeer
Published: 2021-01-20T17:46:54.969Z
CVE-2020-28453 Command Injection
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: npos-tesseract
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: JHU System Security Lab
Published: 2022-08-02T13:25:31.635Z
CVE-2020-28455 Cross-site Scripting (XSS)
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: markdown-it-toc
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: ooooooo_q
Published: 2022-07-25T14:10:37.856Z
CVE-2020-28456 Cross-site Scripting (XSS)
The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: s-cart/core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdul Muhaimin
Published: 2020-12-15T15:35:21.935Z
CVE-2020-28457 Cross-site Scripting (XSS)
This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: s-cart/core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 6.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P
version: 3.1
Credits: lang: en
value: Abdul Muhaimin
Published: 2020-12-15T15:35:14.870Z
CVE-2020-28458 Prototype Pollution
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: datatables.net
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Alessio Della Libera (d3lla)
Published: 2020-12-16T10:35:20.456Z
CVE-2020-28459 Cross-site Scripting (XSS)
This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: markdown-it-decorate
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: ooooooo_q
Published: 2022-07-25T14:05:43.371Z