Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2021-23420

Deserialization of Untrusted Data

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

CVSS 3.1 · 7.7 High EPSS 2.7% KEV · Not listed
Vendors
Codeception
Products
Codeception
CVE-2021-23419

Prototype Pollution

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed
Vendors
Open-graph Project
Products
Open-graph
CVE-2021-23418

XML External Entity (XXE) Injection

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Glances Project
Products
Glances
CVE-2021-23415

Directory Traversal

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Elfinder.aspnet Project
Products
Elfinder.aspnet
CVE-2021-23414

Cross-site Scripting (XSS)

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Videojs
Products
Fedora Video.js
CVE-2021-23413

Denial of Service (DoS)

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

CVSS 3.1 · 5.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Jszip Project
Products
Jszip
CVE-2021-23412

Command Injection

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.

CVSS 3.1 · 8.1 High EPSS 4.0% KEV · Not listed
Vendors
Gitlogplus Project
Products
Gitlogplus
CVE-2021-23411

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Anchorme Project
Products
Anchorme
CVE-2021-23409

Denial of Service (DoS)

The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Go-proxyproto Project
Products
Go-proxyproto
CVE-2021-23408

Prototype Pollution

This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Graphhopper
Products
Graphhopper
CVE-2021-23407

Directory Traversal

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Elfinder.net.core Project
Products
Elfinder.net.core
CVE-2021-23406

Remote Code Execution (RCE)

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

CVSS 3.1 · 8.1 High EPSS 2.9% KEV · Not listed
Vendors
Pac-resolver Project
Products
Pac-resolver
CVE-2021-23405

SQL Injection

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

CVSS 3.1 · 8.3 High EPSS 1.7% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2021-23404

Cross-site Request Forgery (CSRF)

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Sqlite-web Project
Products
Sqlite-web
CVE-2021-23403

Prototype Pollution

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed
Vendors
Ts-nodash Project
Products
Ts-nodash
CVE-2021-23401

Open Redirect

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Flask-user Project
Products
Flask-user
CVE-2021-23400

HTTP Header Injection

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

CVSS 3.1 · 6.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Nodemailer
Products
Nodemailer