This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk’s internal network via directory traversal.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-7649
https://github.com/snyk/broker/commi…
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
Refer…
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-23373
https://security.snyk.io/vuln/SNYK-JS-SETDEEPPROP-1083231
https://github.com/advisories/…
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-23451
https://github.com/M…
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28455
https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067…
A command injection vulnerability affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28443
https://security.snyk.io/vuln/SNYK-JS-SONARWRAPPER-105098…
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
Referenc…
The package ntesseract before 0.2.9 is vulnerable to Command Injection via lib/tesseract.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28446
https://github.com/taoyuan/ntesseract/commit/fcbc36f381798b4362179c0cdf9961b437c7b619
https://secur…
Duplicate Advisory
This advisory is a duplicate of GHSA-hrgx-p36p-89q4. This link is maintained to preserve external references.
Original Description
PrestaShop 1.6.0.10 through 1.7.x before 1.7.8.2 allows remote attackers to execute arbitrary code, ak…
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Version 1.11.2 contains a fix.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-34115
https://github.com/dataease/dataease/issues/2428
https:/…
