CVE-2020-28439

CVE-2020-28439 affects all versions of the npm package corenlp-js-prefab . The root cause is a dependency on the vulnerable corenlp-js-interface , with an injection point in the package’s index.js (line 10). Impact is command injection leading to potential arbitrary command execution when the mai...

CVE-2020-28439 Command Injection

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

CVE-2020-28439

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

CVE-2020-28440 Command Injection

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...

CVE-2020-28440

CVE-2020-28440 affects the npm package corenlp-js-interface . All versions are vulnerable to Command Injection via the main function . Public sources (SNYK, NVD, CVE records) describe that a crafted input can be executed by the package when invoked through its main entry. The SNYK entry provides ...

CVE-2020-28440

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...

Command Injection

Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...

Command Injection

Overview corenlp-js-prefab is a deprecated package. Uses corenlp-js-interface with a simple prefab function so you only have to send text no extra parameters with each call. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var...

DEBIAN-CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

UBUNTU-CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

Design/Logic Flaw

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

CVE-2020-7793

CVE-2020-7793 affects the UAParser.js package (versions before 0.7.23). The vulnerability is a Regular Expression Denial of Service (ReDoS) across multiple regexes. Connected sources explicitly identify UAParser.js (pre-0.7.23) as vulnerable and reference the ReDoS condition; one source notes a f...

CVE-2020-7793 Regular Expression Denial of Service (ReDoS)

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

CVE-2020-28440: Improper Neutralization of Special Elements used in an OS Command

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...

PT-2020-17010

Name of the Vulnerable Software and Affected Versions corenlp-js-interface versions all Description The issue concerns Command Injection via the main function. Recommendations For all versions, consider disabling the main function as a temporary workaround until a patch is available. At the momen...

ua-parser-js security vulnerability

ua-parser-js is a JavaScript-based parser for User-Agent strings. It can be used in a browser client-side or node.js server-side environment. Can also be used as a jQuery / Zepto plugin , Bower / Meteor package and RequireJS / AMD module . A security vulnerability exists in ua-parser-js prior to...

CVE-2020-7793: Undefined Security Weakness

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...