CVE-2020-7724

Prototype Pollution

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Tiny-conf Project

Products

Tiny-conf

CVE-2020-7723

Prototype Pollution

All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Yola

Products

Promisehelpers

CVE-2020-7722

Prototype Pollution

All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Nodee-utils Project

Products

Nodee-utils

CVE-2020-7721

Prototype Pollution

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Node-oojs Project

Products

Node-oojs

CVE-2020-7720

Prototype Pollution

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed

Vendors

Digitalbazaar Redhat

Products

Forge Ansible Tower Openshift Container Storage

CVE-2020-7719

Prototype Pollution

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Locutus

Products

Locutus

CVE-2020-7718

Prototype Pollution

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Gammautils Project

Products

Gammautils

CVE-2020-7717

Prototype Pollution

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Dot-notes Project

Products

Dot-notes

CVE-2020-7716

Prototype Pollution

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Invertase

Products

Deeps

CVE-2020-7715

Prototype Pollution

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed

Vendors

Deep-get-set Project

Products

Deep-get-set

CVE-2020-7714

Prototype Pollution

All versions of package confucious are vulnerable to Prototype Pollution via the set function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Realseriousgames

Products

Confucious

CVE-2020-7713

Prototype Pollution

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Arr-flatten-unflatten Project

Products

Arr-flatten-unflatten

CVE-2020-7711

Denial of Service (DoS)

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Goxmldsig Project

Products

Goxmldsig

CVE-2020-7710

Sandbox Escape

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.

CVSS 3.1 · 8.1 High EPSS 1.4% KEV · Not listed

Vendors

Safe-eval Project

Products

Safe-eval

CVE-2020-7708

Prototype Pollution

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Irrelon

Products

\@irrelon\/path Irrelon-path

CVE-2020-7707

Prototype Pollution

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Property-expr Project

Products

Property-expr

CVE-2020-7706

Prototype Pollution

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Connie-lang Project

Products

Connie-lang

CVE-2020-7705

Malicious Package

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.

CVSS 3.1 · 7.1 High EPSS 1.2% KEV · Not listed

Vendors

Mintegral

Products

Mintegraladsdk

CVE-2020-7704

Prototype Pollution

The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed

Vendors

Linux-cmdline Project

Products

Linux-cmdline

CVE-2020-7703

Prototype Pollution

All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Nis-utils Project

Products

Nis-utils