4625 matches found
CVE-2020-28442
CVE-2020-28442 (js-data) : Multiple connected sources confirm Prototype Pollution in js-data via the deepFillIn function and, in some advisories, the set function. Affected are all versions prior to the fix, with an incomplete remediation described; the OSV/GHSA entries specify vulnerability acro...
CVE-2020-7793
A flaw was found in nodejs-ua-parser-js. The software is vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes...
Command Injection
corenlp-js-prefab is vulnerable to command injection. The vulnerability is possible via the main function...
Command Injection
corenlp-js-interface is vulnerable to command injection. The vulnerability is possible via the main function...
CVE-2020-28439
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...
CVE-2020-28440
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
Command injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-28439
CVE-2020-28439 affects all versions of the npm package corenlp-js-prefab . The root cause is a dependency on the vulnerable corenlp-js-interface , with an injection point in the package’s index.js (line 10). Impact is command injection leading to potential arbitrary command execution when the mai...
CVE-2020-28439 Command Injection
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...
CVE-2020-28440 Command Injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
CVE-2020-28440
CVE-2020-28440 affects the npm package corenlp-js-interface . All versions are vulnerable to Command Injection via the main function . Public sources (SNYK, NVD, CVE records) describe that a crafted input can be executed by the package when invoked through its main entry. The SNYK entry provides ...
Command Injection
Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...
Command Injection
Overview corenlp-js-prefab is a deprecated package. Uses corenlp-js-interface with a simple prefab function so you only have to send text no extra parameters with each call. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
DEBIAN-CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
Design/Logic Flaw
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
UBUNTU-CVE-2020-7793
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
CVE-2020-7793 Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...
CVE-2020-7793
CVE-2020-7793 affects the UAParser.js package (versions before 0.7.23). The vulnerability is a Regular Expression Denial of Service (ReDoS) across multiple regexes. Connected sources explicitly identify UAParser.js (pre-0.7.23) as vulnerable and reference the ReDoS condition; one source notes a f...