CVE-2020-7726

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7726

CVE-2020-7726 corresponds to prototype pollution in the npm package safe-object2 via the setter function. Affected versions are stated as all versions; the vulnerability enables an attacker to inject properties into Object.prototype (e.g., proto , constructor, prototype), with potential DoS or re...

PT-2020-19747 · Unknown · Safe-Object2

Name of the Vulnerable Software and Affected Versions: safe-object2 versions affected versions not specified Description: The issue concerns Prototype Pollution via the setter function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

@550w-tools/cli (>=0.0.14 <=0.0.16), @550w-tools/core (>=0.0.14 <=0.0.16) +538 more potentially affected by CVE-2020-7710 via safe-eval (>=0.2.0 <=0.4.1)

safe-eval NPM version =0.2.0, =0.0.14, =0.0.14, =0.0.13, =0.0.14, =0.0.15, =1.0.1, =1.0.2, =1.0.3, =1.1.2, =0.1.16, =1.0.0, =0.3.0, =0.20.0, =2.0.295, =2.0.315 and more Source cves: CVE-2020-7710 Source advisory: OSV:GHSA-HRPQ-R399-WHGW...

Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...

GHSA-HRPQ-R399-WHGW Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...

Remote Code Execution (RCE)

safe-eval is vulnerable to remote code execution RCE. The application does not properly sanitize user input, allowing a malicious user to execute arbitrary commands...

CVE-2020-20634

Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog...

CVE-2020-20634

Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog...

Code injection

Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog...

CVE-2020-20634

CVE-2020-20634 affects the Elementor WordPress plugin, versions 2.9.5 and below. The issue allows authenticated users to activate the plugin’s Safe Mode feature, which can be exploited to disable all security plugins on the blog. This is an authentication‑required privilege escalation affecting p...

CVE-2020-20634

Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

CVE-2020-7710 affects all versions of the safe-eval package. The vulnerability arises from the package failing to restrict access to the main JavaScript context via Error objects, enabling a sandbox escape and remote code execution. Proof-of-concept payloads in advisory sources demonstrate how an...

CVE-2020-7710 Sandbox Escape

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

PT-2020-15277 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Elementor versions 2.9.5 and below Description: The issue allows authenticated users to activate the safe mode feature, which can be exploited to disable all security plugins on the blog. Recommendations: For versions 2.9.5 and below, update ...

Regular Expression Denial of Service

Overview All versions of url-regex are vulnerable to a Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. Recommendation There are no patches and the software is not currently maintained. The security researcher who found t...

Prototype Pollution

Overview safe-object2 is a Secure operation object get/set Affected versions of this package are vulnerable to Prototype Pollution via the setter function. POC const safeObj2 = require""safe-object2""; const obj = safeObj2; obj.setter'proto', 'polluted', true console.logpolluted; // true Details...