rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-21144 Denial of Service (DoS)
This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: libxmljs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
version: 3.1
Credits: lang: en
value: Cristian-Alexandru Staicu
lang: en
value: Aviad Hahami
Published: 2022-05-01T15:25:10.325Z
CVE-2022-21145 
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Lansweeper
product: lansweeper
Published: 2022-04-14T19:56:34.061Z
CVE-2022-21146 ICSA-22-062-01 IPCOMM ipDIO
Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts to review history.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: IPCOMM
product: IPCOMM ipDIO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez of S21Sec reported these vulnerabilities to CISA.
Published: 2022-03-09T15:33:11.554Z
CVE-2022-21147 
An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-crafted PE file can trigger this vulnerability to cause denial of service and termination of malware scan. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-823
description: CWE-823: Use of Out-of-range Pointer Offset
Affected products: vendor: ESTsoft
product: Alyac
Published: 2022-05-12T17:01:26.586Z
CVE-2022-21148 
Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Edge Insights for Industrial software
Published: 2022-08-18T19:47:20.000Z
CVE-2022-21149 Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: s-cart/s-cart
vendor: n/a
product: s-cart/core
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Faisal Fs
Published: 2022-05-01T15:30:50.231Z
CVE-2022-21151 
Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2022-05-12T16:36:06.000Z
CVE-2022-21152 
Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Edge Insights for Industrial software
Published: 2022-08-18T19:47:35.000Z
CVE-2022-21153 
Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description:  information disclosure 
Affected products: vendor: n/a
product: Intel(R) Capital Global Summit Android application
Published: 2022-02-09T22:04:49.000Z
CVE-2022-21154 
An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integer overflow, that in turn causes a buffer overflow. An attacker can provide a malicious BMP file to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: Leadtools
product: Leadtools
Published: 2022-04-14T19:56:35.551Z
CVE-2022-21155 Fernhill SCADA Uncontrolled Resource Consumption
A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Fernhill
product: SCADA Server 
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was found independently by ExCraft and Fernhill Software.
Published: 2022-04-12T16:11:56.000Z
CVE-2022-21156 
Access of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description:  denial of service 
Affected products: vendor: n/a
product: Intel(R) Trace Analyzer and Collector
Published: 2022-02-09T22:04:51.000Z
CVE-2022-21157 
Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated user to potentially enable information disclosure via local access.
Problem types: description:  information disclosure 
Affected products: vendor: n/a
product: Intel(R) Smart Campus Android application
Published: 2022-02-09T22:04:53.000Z
CVE-2022-21158 
A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext.
Problem types: description: Cross-site scripting
Affected products: vendor: MarkText
product: MarkText
Published: 2022-03-07T09:00:35.000Z
CVE-2022-21159 
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: MZ Automation GmbH
product: libiec61850
Published: 2022-04-15T16:00:21.545Z
CVE-2022-21160 
Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi products
Published: 2022-08-18T19:41:51.000Z
CVE-2022-21162 
Uncontrolled search path for the Intel(R) HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) HDMI Firmware Update tool for NUC
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:16:56.843Z
CVE-2022-21163 
Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Crypto API Toolkit for Intel(R) SGX
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2023-02-16T20:00:23.821Z
CVE-2022-21164 Denial of Service (DoS)
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: node-lmdb
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 3.5
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
version: 3.1
Credits: lang: en
value: Snyk Research Team
Published: 2022-03-16T15:25:13.291Z
CVE-2022-21165 Arbitrary Command Injection
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
Problem types: description: Arbitrary Command Injection
Affected products: vendor: n/a
product: font-converter
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: OmniTaint
Published: 2022-08-29T05:00:17.008Z
CVE-2022-21166 
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description:  information disclosure 
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2022-06-15T20:03:42.000Z
CVE-2022-21167 Arbitrary Code Execution
All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: Masuit.Tools.Core
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Keyang Yin
lang: en
value: zpbrent(zhou
lang: en
value: peng@shu)
Published: 2022-05-01T15:30:17.128Z
CVE-2022-21168 ICSA-22-090-03 Fuji Electric Alpha5
The affected product is vulnerable due to an invalid pointer initialization, which may lead to information disclosure.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: Fuji Electric
product: Alpha5
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Xina1i, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA
Published: 2022-04-12T16:11:50.947Z
CVE-2022-21169 Prototype Pollution
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: express-xss-sanitizer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: Jayateertha Guruprasad
Published: 2022-09-26T05:05:11.200Z
CVE-2022-21170 
Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.
Problem types: description: Improper check for certificate revocation
Affected products: vendor: Digital Arts Inc.
product: i-FILTER, i-FILTER Browser & Cloud MultiAgent for Windows, and D-SPA using i-FILTER
Published: 2022-03-07T09:00:37.000Z
CVE-2022-21172 
Out of bounds write for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi products
Published: 2022-08-18T19:40:14.000Z
CVE-2022-21173 
Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S firmware v1.05 and earlier, WRH-300WH3-S firmware v1.05 and earlier, and WRH-300YG3-S firmware v1.05 and earlier) allows an attacker on the adjacent network to execute an arbitrary OS command via unspecified vectors.
Problem types: description: Hidden Functionality
Affected products: vendor: ELECOM CO.,LTD.
product: ELECOM LAN routers
Published: 2022-02-08T10:30:32.000Z
CVE-2022-21174 
Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description:  escalation of privilege 
Affected products: vendor: n/a
product: Intel(R) Quartus(R) Prime Pro Edition
Published: 2022-02-09T22:04:49.000Z
CVE-2022-21176 Airspan Networks Mimosa SQL Injection
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Airspan Networks
product: MMP
vendor: Airspan Networks
product: PTP C-series
vendor: Airspan Networks
product: PTMP C-series and A5x
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty reported these vulnerabilities to CISA.
Published: 2022-02-18T17:50:20.075Z
CVE-2022-21177 
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Yokogawa Electric Corporation
product: CENTUM CS 3000
vendor: Yokogawa Electric Corporation
product: CENTUM VP
vendor: Yokogawa Electric Corporation
product: Exaopc
Published: 2022-03-11T09:10:39.000Z
CVE-2022-21178 
An os command injection vulnerability exists in the confsrv ucloud_add_new_node functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:11:00.651Z
CVE-2022-21179 
Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1.0.4 (for EC-CUBE 3 series) allows a remote unauthenticated attacker to hijack the authentication of an administrator via a specially crafted page, and Mail Magazine Templates and/or transmitted history information may be deleted unintendedly.
Problem types: description: Cross-site request forgery
Affected products: vendor: EC-CUBE CO.,LTD.
product: EC-CUBE plugin 'Mail Magazine Management Plugin'
Published: 2022-02-24T09:50:27.000Z
CVE-2022-21180 
Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access.
Problem types: description:  information disclosure 
Affected products: vendor: n/a
product: Intel(R) Processors
Published: 2022-06-15T20:04:21.000Z
CVE-2022-21181 
Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
Published: 2022-08-18T00:00:00.000Z
CVE-2022-21182 
A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:28.102Z
CVE-2022-21184 
An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Bachmann Visutec GmbH
product: Atvise
Published: 2022-06-17T17:40:12.075Z
CVE-2022-21186 Arbitrary Command Injection
The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.
Problem types: description: Arbitrary Command Injection
Affected products: vendor: n/a
product: @acrontum/filesystem-template
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.3
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: Feng Xiao and Zhongfu Su
Published: 2022-08-05T05:00:18.167Z
CVE-2022-21187 Command Injection
The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: libvcs
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alessio Della Libera of Snyk Research Team
Published: 2022-03-14T17:15:17.020Z
CVE-2022-21189 Prototype Pollution
The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: dexie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 6.9
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
version: 3.1
Credits: lang: en
value: Alessio Della Libera of Snyk Security Team
Published: 2022-05-01T15:25:21.478Z