The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2020-7676 | angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select> ones changes parsing behavior, leading to possibly unsanitizing code. | LOW | Jun 8, 2020 | n/a |
| CVE-2020-7675 | cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution. | HIGH | Jun 10, 2020 | n/a |
| CVE-2020-7674 | access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution. | HIGH | Jun 10, 2020 | n/a |
| CVE-2020-7673 | node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution. | HIGH | Jun 10, 2020 | n/a |
| CVE-2020-7672 | mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution. | HIGH | Jun 10, 2020 | n/a |
| CVE-2020-7671 | goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. | MEDIUM | Jun 10, 2020 | n/a |
| CVE-2020-7670 | agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing. | MEDIUM | Jun 10, 2020 | n/a |
| CVE-2020-7669 | This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction. | MEDIUM | Sep 1, 2020 | n/a |
| CVE-2020-7668 | In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn\'t securely escape file paths in zip archives which include leading or non-leading ... This allows an attacker to add or replace files system-wide. | MEDIUM | Jun 23, 2020 | n/a |
| CVE-2020-7667 | In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn\'t sanitize the paths of the archived files for leading and non-leading .. which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released. | MEDIUM | Jun 24, 2020 | n/a |
| CVE-2020-7666 | This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction. | MEDIUM | Sep 4, 2020 | n/a |
| CVE-2020-7665 | This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction. | MEDIUM | Sep 4, 2020 | n/a |
| CVE-2020-7664 | In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn\'t securely escape file paths in zip archives which include leading or non-leading ... This allows an attacker to add or replace files system-wide. | MEDIUM | Jun 23, 2020 | n/a |
| CVE-2020-7663 | websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. | MEDIUM | Jun 4, 2020 | n/a |
| CVE-2020-7662 | websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. | MEDIUM | Jun 4, 2020 | n/a |
| CVE-2020-7661 | all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. | HIGH | Jun 4, 2020 | n/a |
| CVE-2020-7660 | serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js. | MEDIUM | Jun 8, 2020 | n/a |
| CVE-2020-7659 | reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more. | MEDIUM | Jun 2, 2020 | n/a |
| CVE-2020-7658 | meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. | MEDIUM | May 22, 2020 | n/a |
| CVE-2020-7656 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. | MEDIUM | May 20, 2020 | n/a |
| CVE-2020-7655 | netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks. | MEDIUM | May 21, 2020 | n/a |
| CVE-2020-7654 | All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7653 | All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk\'s internal network by creating symlinks to match whitelisted paths. | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7652 | All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk\'s internal network via directory traversal. | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7651 | All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk\'s internal network via patch history from GitHub Commits API. | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7650 | All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk\'s internal network of any files ending in the following extensions: yaml, yml or json. | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7649 | This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk\'s internal network via directory traversal. | -- | Jul 25, 2022 | n/a |
| CVE-2020-7648 | All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk\'s internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json` | MEDIUM | May 30, 2020 | n/a |
| CVE-2020-7647 | All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors. | MEDIUM | May 14, 2020 | n/a |
| CVE-2020-7646 | curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. | HIGH | May 7, 2020 | n/a |
| CVE-2020-7645 | All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems. | HIGH | May 4, 2020 | n/a |
| CVE-2020-7644 | fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of \'Object.prototype\' using a \'__proto__\' payload. | MEDIUM | Apr 28, 2020 | n/a |
| CVE-2020-7643 | paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | MEDIUM | Apr 23, 2020 | n/a |
| CVE-2020-7642 | lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript. | LOW | Apr 22, 2020 | n/a |
| CVE-2020-7641 | This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | -- | Jul 17, 2022 | n/a |
| CVE-2020-7640 | pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization. | HIGH | May 1, 2020 | n/a |
| CVE-2020-7639 | eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function \'set\' could be tricked into adding or modifying properties of \'Object.prototype\' using a \'__proto__\' payload. | MEDIUM | Apr 6, 2020 | n/a |
| CVE-2020-7638 | confinit through 0.3.0 is vulnerable to Prototype Pollution.The \'setDeepProperty\' function could be tricked into adding or modifying properties of \'Object.prototype\' using a \'__proto__\' payload. | MEDIUM | Apr 6, 2020 | n/a |
| CVE-2020-7637 | class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | MEDIUM | Apr 6, 2020 | n/a |
| CVE-2020-7636 | adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7635 | compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7634 | heroku-addonpool through 0.1.15 is vulnerable to Command Injection. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7633 | apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7632 | node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7631 | diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument. | HIGH | Apr 6, 2020 | n/a |
| CVE-2020-7630 | git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument. | HIGH | Apr 2, 2020 | n/a |
| CVE-2020-7629 | install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. | HIGH | Apr 2, 2020 | n/a |
| CVE-2020-7628 | umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization. | HIGH | Apr 2, 2020 | n/a |
| CVE-2020-7627 | node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the \'arrParams\' argument in the \'execute()\' function. | HIGH | Apr 2, 2020 | n/a |
| CVE-2020-7626 | karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument. | HIGH | Apr 2, 2020 | n/a |
