6885 matches found
CVE-2020-28442
CVE-2020-28442 (js-data) : Multiple connected sources confirm Prototype Pollution in js-data via the deepFillIn function and, in some advisories, the set function. Affected are all versions prior to the fix, with an incomplete remediation described; the OSV/GHSA entries specify vulnerability acro...
CVE-2020-28442: Undefined Security Weakness
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...
PT-2020-17011
Name of the Vulnerable Software and Affected Versions js-data versions prior to 3.0.10 Description The issue concerns Prototype Pollution via the deepFillIn function. This allows for potential manipulation of object properties. No information is provided about the estimated number of affected...
CVE-2020-7793
A flaw was found in nodejs-ua-parser-js. The software is vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes...
Command Injection
corenlp-js-prefab is vulnerable to command injection. The vulnerability is possible via the main function...
Command Injection
corenlp-js-interface is vulnerable to command injection. The vulnerability is possible via the main function...
CVE-2020-28439
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...
CVE-2020-28440
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
Command injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-28439
CVE-2020-28439 affects all versions of the npm package corenlp-js-prefab . The root cause is a dependency on the vulnerable corenlp-js-interface , with an injection point in the package’s index.js (line 10). Impact is command injection leading to potential arbitrary command execution when the mai...
CVE-2020-28439 Command Injection
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...
CVE-2020-28439
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...
CVE-2020-28440
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-28440 Command Injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-28440
CVE-2020-28440 affects the npm package corenlp-js-interface . All versions are vulnerable to Command Injection via the main function . Public sources (SNYK, NVD, CVE records) describe that a crafted input can be executed by the package when invoked through its main entry. The SNYK entry provides ...
Command Injection
Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...
Command Injection
Overview corenlp-js-prefab is a deprecated package. Uses corenlp-js-interface with a simple prefab function so you only have to send text no extra parameters with each call. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
