Search vulnerabilities

Expected end of text, found '–' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2020-7768

Prototype Pollution

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Grpc
Products
Grpc
CVE-2020-7767

Regular Expression Denial of Service (ReDoS)

All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.

CVSS 3.1 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Express-validators Project
Products
Express-validators
CVE-2020-7766

Prototype Pollution

This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed
Vendors
Json-ptr Project
Products
Json-ptr
CVE-2020-7765

Prototype Pollution

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Firebase\/util
CVE-2020-7764

Web Cache Poisoning

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Find-my-way Project
Products
Find-my-way
CVE-2020-7761

Regular Expression Denial of Service (ReDoS)

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.

CVSS 3.1 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Absolunet
Products
Kafe
CVE-2020-7760

Regular Expression Denial of Service (ReDoS)

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

CVSS 3.1 · 5.3 Medium EPSS 5.3% KEV · Not listed
Vendors
Codemirror Oracle
Products
Codemirror Application Express Enterprise Manager Express User Interface and 3 more
CVE-2020-7759

SQL Injection

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2020-7758

Path Traversal

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Browserless
Products
Chrome
CVE-2020-7757

Path Traversal

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Droppy Project
Products
Droppy
CVE-2020-7753

Regular Expression Denial of Service (ReDoS)

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Trim Project
Products
Trim
CVE-2020-7752

Command Injection

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

CVSS 3.1 · 8.8 High EPSS 6.7% KEV · Not listed
Vendors
Systeminformation
Products
Systeminformation
CVE-2020-7751

Prototype Pollution

pathval before version 1.1.1 is vulnerable to prototype pollution.

CVSS 3.1 · 6 Medium EPSS 1.5% KEV · Not listed
Vendors
Chaijis
Products
Pathval
CVE-2020-7750

Cross-site Scripting (XSS)

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

CVSS 3.1 · 9.6 Critical EPSS 6.1% KEV · Not listed
Vendors
Mit
Products
Scratch-svg-renderer
CVE-2020-7749

Server-side Request Forgery (SSRF)

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.

CVSS 3.1 · 7.6 High EPSS 1.6% KEV · Not listed
Vendors
Osm-static-maps Project
Products
Osm-static-maps
CVE-2020-7748

Prototype Pollution

This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

CVSS 3.1 · 5.6 Medium EPSS 1.7% KEV · Not listed
Vendors
Ts.ed Project
Products
Ts.ed
CVE-2020-7747

Cross-site Scripting (XSS)

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lightning-viz
Products
Lightning