Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2021-23520

Arbitrary File Write via Archive Extraction (Zip Slip)

The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Juce
Products
Juce
CVE-2021-23518

Prototype Pollution

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed
Vendors
Cached-path-relative Project Debian Redhat
Products
Cached-path-relative Debian Linux Acm
CVE-2021-23514

Path Traversal

This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Crowcpp
Products
Crow
CVE-2021-23509

Prototype Pollution

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

CVSS 3.1 · 5.6 Medium EPSS 1.8% KEV · Not listed
Vendors
Json-ptr Project
Products
Json-ptr
CVE-2021-23507

Prototype Pollution

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Skratchdot
Products
Object-path-set
CVE-2021-23497

Prototype Pollution

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Set Project
Products
Set
CVE-2021-23495

Open Redirect

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Karma Project
Products
Karma
CVE-2021-23490

Regular Expression Denial of Service (ReDoS)

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Parse-link-header Project
Products
Parse-link-header
CVE-2021-23484

Arbitrary File Write via Archive Extraction (Zip Slip)

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Zip-local Project
Products
Zip-local
CVE-2021-23472

Cross-site Scripting (XSS)

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

CVSS 3.1 · 3.1 Low EPSS 2.4% KEV · Not listed
Vendors
Bootstrap-table
Products
Bootstrap Table
CVE-2021-23470

Prototype Pollution

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

CVSS 3.1 · 8.2 High EPSS 1.3% KEV · Not listed
Vendors
Putil-merge Project
Products
Putil-merge
CVE-2021-23463

XML External Entity (XXE) Injection

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

CVSS 3.1 · 8.1 High EPSS 2.8% KEV · Not listed
Vendors
H2database
Products
H2
CVE-2021-23460

Prototype Pollution

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Camunda
Products
Min-dash
CVE-2021-23452

Prototype Pollution

This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.

CVSS 3.1 · 8.6 High EPSS 1.6% KEV · Not listed
Vendors
Binaryops
Products
X-assign
CVE-2021-23451

Insecure Randomness

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Otp-generator Project
Products
Otp-generator
CVE-2021-23449

Sandbox Bypass

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Vm2 Project
Products
Vm2
CVE-2021-23447

Cross-site Scripting (XSS)

This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Teddy Project
Products
Teddy
CVE-2021-23446

Regular Expression Denial of Service (ReDoS)

The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Handsontable
Products
Handsontable