Total
83323 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7774 | 3 Oracle, Siemens, Y18n Project | 3 Graalvm, Sinec Infrastructure Network Services, Y18n | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
| The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. | |||||
| CVE-2020-7772 | 1 Doc-path Project | 1 Doc-path | 2024-11-21 | 10.0 HIGH | 7.5 HIGH |
| This affects the package doc-path before 2.1.2. | |||||
| CVE-2020-7771 | 1 Asciitable.js Project | 1 Asciitable.js | 2024-11-21 | 7.5 HIGH | 7.5 HIGH |
| The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. | |||||
| CVE-2020-7769 | 1 Nodemailer | 1 Nodemailer | 2024-11-21 | 7.5 HIGH | 8.6 HIGH |
| This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails. | |||||
| CVE-2020-7768 | 1 Grpc | 1 Grpc | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. | |||||
| CVE-2020-7766 | 1 Json-ptr Project | 1 Json-ptr | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
| This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution. | |||||
| CVE-2020-7763 | 1 Jsreport | 1 Phantom-html-to-pdf | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package phantom-html-to-pdf before 0.6.1. | |||||
| CVE-2020-7758 | 1 Browserless | 1 Chrome | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server. | |||||
| CVE-2020-7754 | 1 Npmjs | 1 Npm-user-validate | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. | |||||
| CVE-2020-7753 | 1 Trim Project | 1 Trim | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). | |||||
| CVE-2020-7752 | 1 Systeminformation | 1 Systeminformation | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands. | |||||
| CVE-2020-7749 | 1 Osm-static-maps Project | 1 Osm-static-maps | 2024-11-21 | 6.5 MEDIUM | 7.6 HIGH |
| This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read. | |||||
| CVE-2020-7746 | 1 Chartjs | 1 Chart.js | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution. | |||||
| CVE-2020-7745 | 1 Mintegral | 1 Mintegraladsdk | 2024-11-21 | 10.0 HIGH | 7.1 HIGH |
| This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device. | |||||
| CVE-2020-7743 | 1 Mathjs | 1 Mathjs | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
| The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. | |||||
| CVE-2020-7742 | 1 Simpl-schema Project | 1 Simpl-schema | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package simpl-schema before 1.10.2. | |||||
| CVE-2020-7740 | 1 Node-pdf-generator Project | 1 Node-pdf-generator | 2024-11-21 | 6.4 MEDIUM | 8.2 HIGH |
| This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack. | |||||
| CVE-2020-7739 | 1 Phantomjs-seo Project | 1 Phantomjs-seo | 2024-11-21 | 6.4 MEDIUM | 8.2 HIGH |
| This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack. | |||||
| CVE-2020-7738 | 1 Shiba Project | 1 Shiba | 2024-11-21 | 6.5 MEDIUM | 8.3 HIGH |
| All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad(). | |||||
| CVE-2020-7737 | 1 Safetydance Project | 1 Safetydance | 2024-11-21 | 7.5 HIGH | 7.3 HIGH |
| All versions of package safetydance are vulnerable to Prototype Pollution via the set function. | |||||