Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

309 matches found

NVD
NVD•added 2021/03/26 10:15 p.m.•27 views

CVE-2021-21372

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger...

8.8CVSS0.03635EPSS
SaveExploits1References4
NVD
NVD•added 2021/03/26 10:15 p.m.•54 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS0.01044EPSS
SaveExploits1References4
OSV
OSV•added 2021/03/26 10:15 p.m.•4 views

DEBIAN-CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

5.9CVSS6.7AI score0.01155EPSS
SaveExploits1References1
OSV
OSV•added 2021/03/26 10:15 p.m.•24 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.1AI score
SaveExploits0References4
NVD
NVD•added 2021/03/26 10:15 p.m.•28 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS0.01155EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB•added 2021/03/26 10:15 p.m.•6 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.3AI score0.01044EPSS
SaveExploits1References5Affected Software1
OSV
OSV•added 2021/03/26 10:15 p.m.•27 views

UBUNTU-CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.3AI score0.01044EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB•added 2021/03/26 10:15 p.m.•7 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS6.8AI score0.01155EPSS
SaveExploits1References4Affected Software1
UbuntuCve
UbuntuCve•added 2021/03/26 10:15 p.m.•20 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS6.8AI score0.01155EPSS
SaveExploits1References2
Prion
Prion•added 2021/03/26 10:15 p.m.•31 views

Remote code execution

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

6.8CVSS8.2AI score0.01044EPSS
SaveExploits1References4Affected Software1
Prion
Prion•added 2021/03/26 10:15 p.m.•16 views

Design/Logic Flaw

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger...

6.8CVSS8.9AI score0.03635EPSS
SaveExploits1References4Affected Software1
Prion
Prion•added 2021/03/26 10:15 p.m.•22 views

Remote code execution

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

4.3CVSS6.2AI score0.01155EPSS
SaveExploits1References3Affected Software1
UbuntuCve
UbuntuCve•added 2021/03/26 10:15 p.m.•36 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS7.2AI score0.01044EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve•added 2021/03/26 10:15 p.m.•30 views

CVE-2021-21372

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger...

8.8CVSS7.5AI score0.03635EPSS
SaveExploits1References2
OSV
OSV•added 2021/03/26 10:15 p.m.•22 views

UBUNTU-CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS5.9AI score0.01155EPSS
SaveExploits1References3
OSV
OSV•added 2021/03/26 10:15 p.m.•17 views

UBUNTU-CVE-2021-21372

Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger...

8.8CVSS7.6AI score0.03635EPSS
SaveExploits1References3
CVE
CVE•added 2021/03/26 9:25 p.m.•197 views

CVE-2021-21373

CVE-2021-21373 affects Nimble, the Nim package manager. The issue arises when nimble refresh fetches the package list over HTTPS but falls back to an insecure HTTP URL on error, enabling a MitM to deliver a malicious package list. If affected packages are installed, this can lead to untrusted cod...

7.5CVSS7.2AI score0.01155EPSS
SaveExploits1References3Affected Software1
Cvelist
Cvelist•added 2021/03/26 9:25 p.m.•33 views

CVE-2021-21373 Nimble falls back to insecure http url when fetching packages

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS8.4AI score0.01155EPSS
SaveExploits1References3
Debian CVE
Debian CVE•added 2021/03/26 9:25 p.m.•80 views

CVE-2021-21373

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS by default. In case of error it falls back to a non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker...

7.5CVSS6.8AI score0.01155EPSS
SaveExploits1
Debian CVE
Debian CVE•added 2021/03/26 9:25 p.m.•80 views

CVE-2021-21374

Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verification of the SSL/TLS certificate due to the default setting of httpClient. An attacker able to...

8.1CVSS8.2AI score0.01044EPSS
SaveExploits1
Rows per page
Query Builder