Search vulnerabilities

Expected end of text, found '–' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2020-7790

Arbitrary File Read

This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Spatie
Products
Browsershot
CVE-2020-7787

Improper Authentication

This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.

CVSS 3.1 · 8.2 High EPSS 1.3% KEV · Not listed
Vendors
React-adal Project
Products
React-adal
CVE-2020-7786

Command Injection

This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Macfromip Project
Products
Macfromip
CVE-2020-7785

Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Node-ps Project
Products
Node-ps
CVE-2020-7784

command_injection

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Ts-process-promises Project
Products
Ts-process-promises
CVE-2020-7782

Command Injection

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Spritesheet-js Project
Products
Spritesheet-js
CVE-2020-7781

Command Injection

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Connection-tester Project
Products
Connection-tester
CVE-2020-7780

Cross-site Request Forgery (CSRF)

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Softwaremill
Products
Akka-http-session
CVE-2020-7779

Regular Expression Denial of Service (ReDoS)

All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Djvalidator Project
Products
Djvalidator
CVE-2020-7778

Prototype Pollution

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.

CVSS 3.1 · 7.3 High EPSS 2.4% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-7777

Arbitrary Code Execution

This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.

CVSS 3.1 · 7.2 High EPSS 2.1% KEV · Not listed
Vendors
Jsen Project
Products
Jsen
CVE-2020-7776

Cross-site Scripting (XSS)

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.

CVSS 3.1 · 7.1 High EPSS 1.3% KEV · Not listed
Vendors
Phpoffice
Products
Phpspreadsheet
CVE-2020-7775

Command Injection

This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Freediskspace Project
Products
Freediskproject
CVE-2020-7773

Cross-site Scripting (XSS)

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Markdown-it-highlightjs Project
Products
Markdown-it-highlightjs
CVE-2020-7770

Prototype Pollution

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Json8 Project
Products
Json8
CVE-2020-7769

Command Injection

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

CVSS 3.1 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Nodemailer
Products
Nodemailer