The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date |
|---|---|---|---|
| CVE-2020-7758 | This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server. | MEDIUM | Nov 3, 2020 |
| CVE-2020-7757 | This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server. | -- | Nov 3, 2020 |
| CVE-2020-7755 | All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values. | -- | Oct 27, 2020 |
| CVE-2020-7754 | This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters. | MEDIUM | Oct 27, 2020 |
| CVE-2020-7753 | All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). | MEDIUM | Oct 27, 2020 |
| CVE-2020-7752 | This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl\'s parameters to overwrite Javascript files and then execute any OS commands. | MEDIUM | Oct 30, 2020 |
| CVE-2020-7751 | pathval before version 1.1.1 is vulnerable to prototype pollution. | MEDIUM | Oct 26, 2020 |
| CVE-2020-7750 | This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function. | -- | Oct 21, 2020 |
| CVE-2020-7749 | This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read. | -- | Oct 20, 2020 |
| CVE-2020-7748 | This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program. | MEDIUM | Oct 21, 2020 |
| CVE-2020-7747 | This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller. | LOW | Oct 22, 2020 |
| CVE-2020-7746 | This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution. | MEDIUM | Oct 29, 2020 |
| CVE-2020-7745 | This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device. | -- | Oct 19, 2020 |
| CVE-2020-7744 | This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android\'s download manager and detects if the downloaded file\'s url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral\'s servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background). | -- | Oct 15, 2020 |
| CVE-2020-7743 | The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. | -- | Oct 13, 2020 |
| CVE-2020-7742 | This affects the package simpl-schema before 1.10.2. | MEDIUM | Oct 7, 2020 |
| CVE-2020-7741 | This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1). | -- | Oct 6, 2020 |
| CVE-2020-7740 | This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack. | -- | Oct 6, 2020 |
| CVE-2020-7739 | This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack. | -- | Oct 6, 2020 |
| CVE-2020-7738 | All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad(). | MEDIUM | Oct 6, 2020 |
| CVE-2020-7737 | All versions of package safetydance are vulnerable to Prototype Pollution via the set function. | HIGH | Oct 9, 2020 |
| CVE-2020-7736 | The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function. | HIGH | Oct 2, 2020 |
| CVE-2020-7735 | The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option. | -- | Sep 25, 2020 |
| CVE-2020-7734 | All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column. | -- | Sep 22, 2020 |
| CVE-2020-7733 | The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. | -- | Sep 16, 2020 |
| CVE-2020-7731 | This affects all versions <0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. | MEDIUM | May 9, 2021 |
| CVE-2020-7730 | The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. | -- | Sep 4, 2020 |
| CVE-2020-7729 | The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML. | -- | Sep 3, 2020 |
| CVE-2020-7727 | All versions of package gedi are vulnerable to Prototype Pollution via the set function. | HIGH | Sep 2, 2020 |
| CVE-2020-7726 | All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function. | HIGH | Sep 2, 2020 |
| CVE-2020-7725 | All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. | HIGH | Sep 2, 2020 |
| CVE-2020-7724 | All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. | HIGH | Sep 2, 2020 |
| CVE-2020-7723 | All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. | HIGH | Sep 3, 2020 |
| CVE-2020-7722 | All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function. | HIGH | Sep 2, 2020 |
| CVE-2020-7721 | All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. | HIGH | Sep 2, 2020 |
| CVE-2020-7720 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions. | HIGH | Sep 4, 2020 |
| CVE-2020-7719 | Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. | HIGH | Sep 3, 2020 |
| CVE-2020-7718 | All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. | HIGH | Sep 2, 2020 |
| CVE-2020-7717 | All versions of package dot-notes are vulnerable to Prototype Pollution via the create function. | HIGH | Sep 2, 2020 |
| CVE-2020-7716 | All versions of package deeps are vulnerable to Prototype Pollution via the set function. | HIGH | Sep 2, 2020 |
| CVE-2020-7715 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function. | HIGH | Sep 2, 2020 |
| CVE-2020-7714 | All versions of package confucious are vulnerable to Prototype Pollution via the set function. | HIGH | Sep 2, 2020 |
| CVE-2020-7713 | All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor. | HIGH | Sep 2, 2020 |
| CVE-2020-7712 | This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function. | MEDIUM | Aug 30, 2020 |
| CVE-2020-7711 | This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. | MEDIUM | Aug 23, 2020 |
| CVE-2020-7710 | This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine. | HIGH | Aug 21, 2020 |
| CVE-2020-7709 | This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported. | MEDIUM | Oct 5, 2020 |
| CVE-2020-7708 | The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions. | HIGH | Aug 19, 2020 |
| CVE-2020-7707 | The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function. | HIGH | Aug 18, 2020 |
| CVE-2020-7706 | The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie. | HIGH | Aug 18, 2020 |
