rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7726 Prototype Pollution
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: safe-object2
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:50:15.412Z
CVE-2020-7727 Prototype Pollution
All versions of package gedi are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: gedi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-09-01T09:50:11.729Z
CVE-2020-7729 Arbitrary Code Execution
The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: grunt
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.8
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/RL:O
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-09-03T09:00:15.371Z
CVE-2020-7730 Command Injection
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: bestzip
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nathan Friedly
Published: 2020-09-04T09:30:14.880Z
CVE-2020-7731 Denial of Service (DoS)
This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: github.com/russellhaering/gosaml2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
baseScore: 7.5
temporalScore: 7.1
baseSeverity: HIGH
temporalSeverity: HIGH
Credits: lang: en
value: Steven Johnstone
Published: 2021-04-30T16:10:13.540Z
CVE-2020-7733 Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: ua-parser-js
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Yeting Li
Published: 2020-09-16T14:10:14.452Z
CVE-2020-7734 Cross-site Scripting (XSS)
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: cabot
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: FUNCTIONAL
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:F
version: 3.1
Credits: lang: en
value: anonartistnot0
Published: 2020-09-22T08:00:24.357Z
CVE-2020-7735 Command Injection
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: ng-packagr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-09-25T12:10:15.254Z
CVE-2020-7736 Prototype Pollution
The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: bmoor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-10-02T09:25:12.523Z
CVE-2020-7737 Prototype Pollution
All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: safetydance
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: NerdJS
Published: 2020-10-02T09:30:13.280Z
CVE-2020-7738 Arbitrary Code Execution
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: shiba
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-10-02T10:05:13.792Z
CVE-2020-7739 Server-side Request Forgery (SSRF)
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
Problem types: description: Server-side Request Forgery (SSRF)
Affected products: vendor: n/a
product: phantomjs-seo
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Vasilii Ermilov
Published: 2020-10-06T15:10:12.999Z
CVE-2020-7740 Server-side Request Forgery (SSRF)
This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
Problem types: description: Server-side Request Forgery (SSRF)
Affected products: vendor: n/a
product: node-pdf-generator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Vasilii Ermilov
Published: 2020-10-06T16:40:13.357Z
CVE-2020-7741 Cross-site Scripting (XSS)
This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: hellojs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Anonymous Reporter
Published: 2020-10-06T14:30:15.993Z
CVE-2020-7742 Prototype Pollution
This affects the package simpl-schema before 1.10.2.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: simpl-schema
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Alessio Della Libera (d3lla)
Published: 2020-10-07T08:55:12.285Z
CVE-2020-7743 Prototype Pollution
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: mathjs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Alessio Della Libera (d3lla)
Published: 2020-10-13T09:15:16.908Z
CVE-2020-7744 Information Exposure
This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background).
Problem types: description: Information Exposure
Affected products: vendor: n/a
product: com.mintegral.msdk:alphab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-10-15T12:40:13.635Z
CVE-2020-7745 Malicious Package
This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device.
Problem types: description: Malicious Package
Affected products: vendor: n/a
product: MintegralAdSDK
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:H/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-10-19T09:55:14.678Z
CVE-2020-7746 Prototype Pollution
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: chart.js
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Alessio Della Libera (d3lla)
Published: 2020-10-29T08:05:17.720Z
CVE-2020-7747 Cross-site Scripting (XSS)
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: lightning-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-10-20T10:25:15.016Z
CVE-2020-7748 Prototype Pollution
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: @tsed/core
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-10-20T10:25:21.517Z
CVE-2020-7749 Server-side Request Forgery (SSRF)
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Problem types: description: Server-side Request Forgery (SSRF)
Affected products: vendor: n/a
product: osm-static-maps
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: REASONABLE
scope: UNCHANGED
temporalScore: 6.4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:R
version: 3.1
Credits: lang: en
value: Vasilii Ermilov
Published: 2020-10-20T10:25:26.929Z
CVE-2020-7750 Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: scratch-svg-renderer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: apple502j
Published: 2020-10-21T16:20:12.796Z
CVE-2020-7751 Prototype Pollution
pathval before version 1.1.1 is vulnerable to prototype pollution.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: pathval
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: posix
Published: 2020-10-25T15:55:14.667Z
CVE-2020-7752 Command Injection
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: systeminformation
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: EffectRenan
Published: 2020-10-26T17:12:38.827Z
CVE-2020-7753 Regular Expression Denial of Service (ReDoS)
All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: trim
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Liyuan Chen
Published: 2020-10-27T08:15:15.542Z
CVE-2020-7754 Regular Expression Denial of Service (ReDoS)
This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: npm-user-validate
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Yeting Li
Published: 2020-10-27T15:05:18.052Z
CVE-2020-7755 Regular Expression Denial of Service (ReDoS)
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: dat.gui
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Yeting Li
Published: 2020-10-27T17:45:14.470Z
CVE-2020-7757 Path Traversal
This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: droppy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.2
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-11-02T18:30:16.073Z
CVE-2020-7758 Path Traversal
This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: browserless-chrome
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: OFFICIAL_FIX
reportConfidence: REASONABLE
scope: UNCHANGED
temporalScore: 6.5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:R
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2020-11-02T18:30:22.046Z