Total
82278 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7678 | 1 Node-import Project | 1 Node-import | 2024-11-21 | N/A | 8.6 HIGH |
| This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js". | |||||
| CVE-2020-7677 | 3 Debian, Fedoraproject, Thenify Project | 3 Debian Linux, Fedora, Thenify | 2024-11-21 | N/A | 8.6 HIGH |
| This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization. | |||||
| CVE-2020-7672 | 1 Mosc Project | 1 Mosc | 2024-11-21 | 7.5 HIGH | 8.6 HIGH |
| mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution. | |||||
| CVE-2020-7671 | 1 Goliath Project | 1 Goliath | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. | |||||
| CVE-2020-7670 | 1 Ohler | 1 Agoo | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing. | |||||
| CVE-2020-7669 | 1 U-root | 1 U-root | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction. | |||||
| CVE-2020-7668 | 1 Compression And Archive Extensions Tz Project | 1 Compression And Archive Extensions Tz Project | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. | |||||
| CVE-2020-7667 | 1 Sas | 1 Go Rpm Utils | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released. | |||||
| CVE-2020-7666 | 1 U-root | 1 U-root | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction. | |||||
| CVE-2020-7665 | 1 U-root | 1 U-root | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction. | |||||
| CVE-2020-7664 | 1 Compression And Archive Extensions Project | 1 Compression And Archive Extensions Zip Project | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. | |||||
| CVE-2020-7663 | 1 Websocket-extensions Project | 1 Websocket-extensions | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. | |||||
| CVE-2020-7662 | 1 Websocket-extensions Project | 1 Websocket-extensions | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. | |||||
| CVE-2020-7661 | 1 Url-regex Project | 1 Url-regex | 2024-11-21 | 7.8 HIGH | 7.5 HIGH |
| all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. | |||||
| CVE-2020-7660 | 1 Verizon | 1 Serialize-javascript | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". | |||||
| CVE-2020-7659 | 1 Celluloid | 1 Reel | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more. | |||||
| CVE-2020-7654 | 1 Synk | 1 Broker | 2024-11-21 | 4.3 MEDIUM | 7.5 HIGH |
| All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. | |||||
| CVE-2020-7644 | 1 Fun-map Project | 1 Fun-map | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload. | |||||
| CVE-2020-7615 | 1 Fsa Project | 1 Fsa | 2024-11-21 | 4.6 MEDIUM | 7.8 HIGH |
| fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands. | |||||
| CVE-2020-7613 | 1 Clamscan Project | 1 Clamscan | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue. | |||||