CVE-2021-23398

Cross-site Scripting (XSS)

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed

Vendors

React-bootstrap-table Project

Products

React-bootstrap-table

CVE-2021-23397

Prototype Pollution

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Merge Project

Products

Merge

CVE-2021-23396

Prototype Pollution

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.

CVSS 3.1 · 5.6 Medium EPSS 1.0% KEV · Not listed

Vendors

Lutils Project

Products

Lutils

CVE-2021-23395

Prototype Pollution

This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Nedb Project

Products

Nedb

CVE-2021-23394

Remote Code Execution (RCE)

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.

CVSS 3.1 · 8.1 High EPSS 18.9% KEV · Not listed

Vendors

Std42

Products

Elfinder

CVE-2021-23393

Open Redirect

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Flask Unchained Project

Products

Flask Unchained

CVE-2021-23392

Regular Expression Denial of Service (ReDoS)

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Locutus

Products

Locutus

CVE-2021-23391

Arbitrary File Write via Archive Extraction (Zip Slip)

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Calipso Project

Products

Calipso

CVE-2021-23390

Arbitrary Code Execution

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed

Vendors

Totaljs

Products

Total4

CVE-2021-23389

Arbitrary Code Execution

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed

Vendors

Totaljs

Products

Total.js

CVE-2021-23388

Regular Expression Denial of Service (ReDoS)

The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Forms Project

Products

Forms

CVE-2021-23387

Open Redirect

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Trailing-slash Project

Products

Trailing-slash

CVE-2021-23386

Remote Memory Exposure

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

CVSS 3.1 · 7.7 High EPSS 1.4% KEV · Not listed

Vendors

Dns-packet Project

Products

Dns-packet

CVE-2021-23385

Open Redirect

This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed

Vendors

Flask-security Project

Products

Flask-security

CVE-2021-23384

Open Redirect

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::removeTrailingSlashes(), as the web server uses relative URLs instead of absolute URLs.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Koa-remove-trailing-slashes Project

Products

Koa-remove-trailing-slashes

CVE-2021-23382

Regular Expression Denial of Service (ReDoS)

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Postcss Redhat

Products

Postcss Acm Openshift and 1 more

CVE-2021-23381

Arbitrary Command Injection

This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed

Vendors

Killing Project

Products

Killing

CVE-2021-23380

Arbitrary Command Injection

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 5.6 Medium EPSS 1.2% KEV · Not listed

Vendors

Roar-pidusage Project

Products

Roar-pidusage

CVE-2021-23379

Arbitrary Command Injection

This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed

Vendors

Portkiller Project

Products

Portkiller

CVE-2021-23378

Arbitrary Command Injection

This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Picotts Project

Products

Picotts