Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2021-23444

Prototype Pollution

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

CVSS 3.1 · 5.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Client
Products
Jointjs
CVE-2021-23443

Cross-site Scripting (XSS)

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adonisjs
Products
Edge
CVE-2021-23442

Prototype Pollution

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

CVSS 3.1 · 8.6 High EPSS 1.6% KEV · Not listed
Vendors
Cookiex-deep Project
Products
Cookiex-deep
CVE-2021-23439

Cross-site Scripting (XSS)

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Johndatserakis
Products
File-upload-with-preview
CVE-2021-23438

Prototype Pollution

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

CVSS 3.1 · 5.6 Medium EPSS 1.7% KEV · Not listed
Vendors
Mpath Project
Products
Mpath
CVE-2021-23437

Regular Expression Denial of Service (ReDoS)

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Python
Products
Fedora Pillow
CVE-2021-23436

Prototype Pollution

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

CVSS 3.1 · 5.6 Medium EPSS 1.8% KEV · Not listed
Vendors
Immer Project Redhat
Products
Immer Jboss Enterprise Bpms Platform
CVE-2021-23435

Open Redirect

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Thoughtbot
Products
Clearance
CVE-2021-23434

Prototype Pollution

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

CVSS 3.1 · 5.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Object-path Project Redhat
Products
Debian Linux Object-path Acm
CVE-2021-23433

Prototype Pollution

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

CVSS 3.1 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Algolia
Products
Algoliasearch-helper
CVE-2021-23432

Prototype Pollution

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mootools Project
Products
Mootools
CVE-2021-23431

Cross-site Request Forgery (CSRF)

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joplinapp
Products
Joplin
CVE-2021-23429

Denial of Service (DoS)

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Transpile Project
Products
Transpile
CVE-2021-23428

Directory Traversal

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal

CVSS 3.1 · 8.6 High EPSS 1.7% KEV · Not listed
Vendors
Elfinder.netcore Project
Products
Elfinder.netcore
CVE-2021-23427

Arbitrary File Write via Archive Extraction (Zip Slip)

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.

CVSS 3.1 · 8.6 High EPSS 1.4% KEV · Not listed
Vendors
Elfinder.netcore Project
Products
Elfinder.netcore
CVE-2021-23426

Prototype Pollution

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Proto Project
Products
Proto
CVE-2021-23424

Regular Expression Denial of Service (ReDoS)

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Ansi-html Project
Products
Ansi-html