stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-25698 (severity: HIGH, weakness: CWE-426)
The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
CVE-2021-25699 (severity: HIGH, weakness: CWE-426)
The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
CVE-2021-25701 (severity: MEDIUM, weakness: CWE-400)
The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which allowed an attacker to cause a denial of service.
CVE-2021-25735 (severity: MEDIUM, weakness: CWE-372)
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
CVE-2021-25736 (severity: MEDIUM, weakness: NVD-CWE-Other)
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.
CVE-2021-25737 (severity: MEDIUM, weakness: CWE-184)
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
CVE-2021-25738 (severity: MEDIUM, weakness: CWE-20)
Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
CVE-2021-25740 (severity: LOW, weakness: CWE-441)
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
CVE-2021-25741 (severity: HIGH, weakness: CWE-20)
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
CVE-2021-25742 (severity: HIGH, weakness: CWE-20)
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
CVE-2021-25743 (severity: LOW, weakness: CWE-150)
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
CVE-2021-25745 (severity: HIGH, weakness: CWE-20)
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2021-25746 (severity: HIGH, weakness: CWE-20)
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2021-25748 (severity: MEDIUM, weakness: CWE-20)
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2021-25749 (severity: HIGH, weakness: CWE-284)
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
CVE-2021-25755 (severity: LOW, weakness: NVD-CWE-Other)
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.
CVE-2021-25756 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
CVE-2021-25757 (severity: MEDIUM, weakness: CWE-601)
In JetBrains Hub before 2020.1.12629, an open redirect was possible.
CVE-2021-25758 (severity: HIGH, weakness: CWE-502)
In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.
CVE-2021-25759 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
CVE-2021-25760 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
CVE-2021-25761 (severity: MEDIUM, weakness: CWE-326)
In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
CVE-2021-25762 (severity: MEDIUM, weakness: CWE-444)
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
CVE-2021-25763 (severity: MEDIUM, weakness: CWE-327)
In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
CVE-2021-25764 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.
CVE-2021-25765 (severity: HIGH, weakness: CWE-352)
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
CVE-2021-25766 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
CVE-2021-25767 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
CVE-2021-25768 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
CVE-2021-25769 (severity: HIGH, weakness: NVD-CWE-Other)
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
CVE-2021-25770 (severity: CRITICAL, weakness: CWE-94)
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
CVE-2021-25771 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
CVE-2021-25772 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
CVE-2021-25773 (severity: MEDIUM, weakness: CWE-79)
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
CVE-2021-25774 (severity: MEDIUM, weakness: CWE-863)
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
CVE-2021-25775 (severity: LOW, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
CVE-2021-25776 (severity: HIGH, weakness: CWE-922)
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
CVE-2021-25777 (severity: MEDIUM, weakness: CWE-863)
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
CVE-2021-25778 (severity: MEDIUM, weakness: NVD-CWE-Other)
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
CVE-2021-25779 (severity: CRITICAL, weakness: CWE-89)
Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page.
CVE-2021-25780 (severity: HIGH, weakness: CWE-434)
An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell.
CVE-2021-25783 (severity: HIGH, weakness: CWE-89)
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.
CVE-2021-25784 (severity: HIGH, weakness: CWE-89)
Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.
CVE-2021-25785 (severity: MEDIUM, weakness: CWE-79)
Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.
CVE-2021-25786 (severity: MEDIUM, weakness: CWE-416)
An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.
CVE-2021-25790 (severity: MEDIUM, weakness: CWE-79)
Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.
CVE-2021-25791 (severity: MEDIUM, weakness: CWE-79)
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.
CVE-2021-25801 (severity: HIGH, weakness: CWE-125)
A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
CVE-2021-25802 (severity: HIGH, weakness: CWE-125)
A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
CVE-2021-25803 (severity: HIGH, weakness: CWE-190)
A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.
CVE-2021-25804 (severity: HIGH, weakness: CWE-476)
A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application.
CVE-2021-25808 (severity: HIGH, weakness: CWE-94)
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.
CVE-2021-25809 (severity: MEDIUM, weakness: CWE-209)
UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php.
CVE-2021-25810 (severity: MEDIUM, weakness: CWE-79)
Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.
CVE-2021-25811 (severity: HIGH, weakness: NVD-CWE-Other)
MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.
CVE-2021-25812 (severity: CRITICAL, weakness: CWE-77)
Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.
CVE-2021-25827 (severity: CRITICAL, weakness: CWE-290)
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
CVE-2021-25828 (severity: MEDIUM, weakness: CWE-79)
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
CVE-2021-25829 (severity: HIGH, weakness: NVD-CWE-Other)
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.
CVE-2021-25830 (severity: CRITICAL, weakness: NVD-CWE-Other)
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
CVE-2021-25831 (severity: CRITICAL, weakness: NVD-CWE-Other)
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.
CVE-2021-25832 (severity: CRITICAL, weakness: CWE-787)
A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions on DocumentServer.
CVE-2021-25833 (severity: CRITICAL, weakness: CWE-22)
A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code execution on DocumentServer.
CVE-2021-25834 (severity: HIGH, weakness: CWE-294)
Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
CVE-2021-25835 (severity: HIGH, weakness: CWE-294)
Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack.
CVE-2021-25836 (severity: HIGH, weakness: NVD-CWE-Other)
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memory(stateObject.code) and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contracts.
CVE-2021-25837 (severity: HIGH, weakness: NVD-CWE-Other)
Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cache data will be discarded at EndBlock, it is still valid in the current block, which enables many possible attacks such as an "arbitrary mint token".
CVE-2021-25838 (severity: MEDIUM, weakness: CWE-79)
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
CVE-2021-25839 (severity: CRITICAL, weakness: CWE-521)
A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.
CVE-2021-25845 (severity: HIGH, weakness: CWE-476)
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet.
CVE-2021-25846 (severity: HIGH, weakness: CWE-191)
Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet.
CVE-2021-25847 (severity: CRITICAL, weakness: CWE-125)
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet.
CVE-2021-25848 (severity: CRITICAL, weakness: CWE-125)
Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet.
CVE-2021-25849 (severity: HIGH, weakness: CWE-191)
An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet.
CVE-2021-25856 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.
CVE-2021-25857 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.
CVE-2021-25863 (severity: HIGH, weakness: CWE-287)
Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.
CVE-2021-25864 (severity: HIGH, weakness: CWE-22)
node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
CVE-2021-25874 (severity: HIGH, weakness: CWE-89)
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.
CVE-2021-25875 (severity: MEDIUM, weakness: CWE-79)
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
CVE-2021-25876 (severity: MEDIUM, weakness: CWE-79)
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
CVE-2021-25877 (severity: HIGH, weakness: CWE-94)
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.
CVE-2021-25878 (severity: MEDIUM, weakness: CWE-79)
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
CVE-2021-25893 (severity: MEDIUM, weakness: CWE-79)
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.
CVE-2021-25894 (severity: MEDIUM, weakness: CWE-79)
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
CVE-2021-25898 (severity: HIGH, weakness: CWE-312)
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server.
CVE-2021-25899 (severity: HIGH, weakness: CWE-89)
An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.
CVE-2021-25900 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.
CVE-2021-25901 (severity: MEDIUM, weakness: CWE-125)
An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
CVE-2021-25902 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.
CVE-2021-25903 (severity: HIGH, weakness: CWE-476)
An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
CVE-2021-25904 (severity: HIGH, weakness: CWE-476)
An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
CVE-2021-25905 (severity: CRITICAL, weakness: CWE-908)
An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
CVE-2021-25906 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
CVE-2021-25907 (severity: CRITICAL, weakness: CWE-415)
An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} double drop can be performed.
CVE-2021-25908 (severity: HIGH, weakness: CWE-415)
An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
CVE-2021-25909 (severity: HIGH, weakness: CWE-400)
ZIV Automation 4CCT-EA6-334126BF firmware version 3.23.80.27.36371, allows an unauthenticated, remote attacker to cause a denial of service condition on the device. An attacker could exploit this vulnerability by sending specific packets to the port 7919.
CVE-2021-25910 (severity: MEDIUM, weakness: CWE-287)
Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user.
CVE-2021-25912 (severity: CRITICAL, weakness: CWE-1321)
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
CVE-2021-25913 (severity: CRITICAL, weakness: CWE-1321)
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25914 (severity: CRITICAL, weakness: CWE-1321)
Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25915 (severity: CRITICAL, weakness: CWE-1321)
Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25916 (severity: CRITICAL, weakness: CWE-1321)
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.