CVE-2020-7xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
830 records · Page 3 of 9
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
UpdatedThis affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
UpdatedAll versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Updated- CVE-2020-7752: Command Injection 8.8 High
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Updated - CVE-2020-7751: Prototype Pollution 6.0 Medium
pathval before version 1.1.1 is vulnerable to prototype pollution.
Updated - CVE-2020-7750: Cross-site Scripting (XSS) 9.6 Critical
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Updated This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for
Updated- CVE-2020-7748: Prototype Pollution 5.6 Medium
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Updated - CVE-2020-7747: Cross-site Scripting (XSS) 6.3 Medium
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Updated - CVE-2020-7746: Prototype Pollution 7.5 High
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Updated - CVE-2020-7745: Malicious Package 7.1 High
This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device.
Updated - CVE-2020-7744: Information Exposure 4.7 Medium
This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android'
Updated - CVE-2020-7743: Prototype Pollution 7.3 High
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Updated - CVE-2020-7742: Prototype Pollution 7.5 High
This affects the package simpl-schema before 1.10.2.
Updated - CVE-2020-7741: Cross-site Scripting (XSS) 9.9 Critical
This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Updated This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
UpdatedThis affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
UpdatedAll versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
Updated- CVE-2020-7737: Prototype Pollution 7.3 High
All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7736: Prototype Pollution 7.3 High
The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7735: Command Injection 6.6 Medium
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Updated All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
UpdatedThe package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
UpdatedThis affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Updated- CVE-2020-7730: Command Injection 9.8 Critical
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Updated The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Updated- CVE-2020-7727: Prototype Pollution 9.8 Critical
All versions of package gedi are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7726: Prototype Pollution 9.8 Critical
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
Updated - CVE-2020-7725: Prototype Pollution 9.8 Critical
All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.
Updated - CVE-2020-7724: Prototype Pollution 9.8 Critical
All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7723: Prototype Pollution 9.8 Critical
All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.
Updated - CVE-2020-7722: Prototype Pollution 9.8 Critical
All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.
Updated - CVE-2020-7721: Prototype Pollution 9.8 Critical
All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.
Updated - CVE-2020-7720: Prototype Pollution 9.8 Critical
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Updated - CVE-2020-7719: Prototype Pollution 9.8 Critical
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
Updated - CVE-2020-7718: Prototype Pollution 9.8 Critical
All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.
Updated - CVE-2020-7717: Prototype Pollution 9.8 Critical
All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.
Updated - CVE-2020-7716: Prototype Pollution 9.8 Critical
All versions of package deeps are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7715: Prototype Pollution 9.8 Critical
All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.
Updated - CVE-2020-7714: Prototype Pollution 9.8 Critical
All versions of package confucious are vulnerable to Prototype Pollution via the set function.
Updated - CVE-2020-7713: Prototype Pollution 9.8 Critical
All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.
Updated - CVE-2020-7712: Command Injection 7.2 High
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Updated This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Updated- CVE-2020-7710: Sandbox Escape 8.1 High
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
Updated - CVE-2020-7709: Prototype Pollution 6.0 Medium
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
Updated - CVE-2020-7708: Prototype Pollution 9.8 Critical
The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Updated - CVE-2020-7707: Prototype Pollution 9.8 Critical
The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Updated - CVE-2020-7706: Prototype Pollution 9.8 Critical
The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
Updated - CVE-2020-7705: Malicious Package 7.1 High
This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods
Updated - CVE-2020-7704: Prototype Pollution 9.8 Critical
The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
Updated - CVE-2020-7703: Prototype Pollution 9.8 Critical
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
Updated - CVE-2020-7702: Prototype Pollution 9.8 Critical
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
Updated - CVE-2020-7701: Prototype Pollution 9.8 Critical
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
Updated - CVE-2020-7700: Prototype Pollution 9.8 Critical
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
Updated - CVE-2020-7699: Prototype Pollution 7.5 High
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Updated - CVE-2020-7698: Command Injection 8.1 High
This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
Updated - CVE-2020-7697: Command Injection 9.8 Critical
This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
Updated - CVE-2020-7696: Information Exposure 5.3 Medium
This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Updated - CVE-2020-7695: HTTP Response Splitting 5.3 Medium
Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Updated - CVE-2020-7694: Log Injection 3.7 Low
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been p
Updated - CVE-2020-7693: Denial of Service (DoS) 5.3 Medium
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Updated PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use
Updated- CVE-2020-7691: Cross-site Scripting (XSS) 6.3 Medium
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
Updated All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
Updated- CVE-2020-7689: Insecure Encryption 5.9 Medium
Data is truncated wrong when its length is greater than 255 bytes.
Updated - CVE-2020-7688: Command Injection 8.4 High
The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Updated - CVE-2020-7687: Directory Traversal 7.5 High
This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
Updated - CVE-2020-7686: Directory Traversal 7.5 High
This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Updated - CVE-2020-7685: Insecure Defaults 5.4 Medium
This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Updated - CVE-2020-7684: Directory Traversal 7.5 High
This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
Updated - CVE-2020-7683: Directory Traversal 7.5 High
This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
Updated - CVE-2020-7682: Directory Traversal 7.5 High
This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
Updated - CVE-2020-7681: Directory Traversal 7.5 High
This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
Updated docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Updated- CVE-2020-7679: Prototype Pollution 7.3 High
In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
Updated This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
UpdatedThis affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Updatedangular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Updatedcd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.
Updatedaccess-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
Updatednode-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Updatedmosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
Updatedgoliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
Updatedagoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insuff
UpdatedThis affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.
UpdatedIn all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
UpdatedIn package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.
UpdatedThis affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.
UpdatedThis affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.
UpdatedIn all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Updatedwebsocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threa
Updatedwebsocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-thread
Updatedall versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
Updatedserialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Updatedreel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is no
Updatedmeinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
Updatedjquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Updatednetius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
UpdatedAll versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.
UpdatedAll versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
Updated