Search vulnerabilities

Expected end of text, found '–' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2020-7746

Prototype Pollution

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Chartjs Redhat
Products
Chart.js Jboss Enterprise Bpms Platform
CVE-2020-7745

Malicious Package

This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device.

CVSS 3.1 · 7.1 High EPSS 2.7% KEV · Not listed
Vendors
Mintegral
Products
Mintegraladsdk
CVE-2020-7744

Information Exposure

This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mintegral
Products
Android Mintegraladsdk
CVE-2020-7743

Prototype Pollution

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

CVSS 3.1 · 7.3 High EPSS 3.9% KEV · Not listed
Vendors
Mathjs Redhat
Products
Mathjs Ansible Tower
CVE-2020-7741

Cross-site Scripting (XSS)

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed
Vendors
Hello.js Project
Products
Hello.js
CVE-2020-7740

Server-side Request Forgery (SSRF)

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

CVSS 3.1 · 8.2 High EPSS 2.0% KEV · Not listed
Vendors
Node-pdf-generator Project
Products
Node-pdf-generator
CVE-2020-7739

Server-side Request Forgery (SSRF)

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.

CVSS 3.1 · 8.2 High EPSS 1.4% KEV · Not listed
Vendors
Phantomjs-seo Project
Products
Phantomjs-seo
CVE-2020-7738

Arbitrary Code Execution

All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().

CVSS 3.1 · 8.3 High EPSS 1.6% KEV · Not listed
Vendors
Shiba Project
Products
Shiba
CVE-2020-7736

Prototype Pollution

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.

CVSS 3.1 · 7.3 High EPSS 1.5% KEV · Not listed
Vendors
Bmoor Project
Products
Bmoor
CVE-2020-7735

Command Injection

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

CVSS 3.1 · 6.6 Medium EPSS 2.4% KEV · Not listed
Vendors
Ng-packagr Project
Products
Ng-packagr
CVE-2020-7734

Cross-site Scripting (XSS)

All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.

CVSS 3.1 · 8.2 High EPSS 1.3% KEV · Not listed
Vendors
Arachnys
Products
Cabot
CVE-2020-7731

Denial of Service (DoS)

This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Gosaml2 Project
Products
Gosaml2
CVE-2020-7730

Command Injection

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Bestzip Project
Products
Bestzip
CVE-2020-7729

Arbitrary Code Execution

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

CVSS 3.1 · 7.1 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Gruntjs
Products
Ubuntu Linux Debian Linux Grunt
CVE-2020-7727

Prototype Pollution

All versions of package gedi are vulnerable to Prototype Pollution via the set function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Gedi Project
Products
Gedi
CVE-2020-7725

Prototype Pollution

All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Guidesmiths
Products
Worksmith