CVE-2020-8203

nodejs-lodash: prototype pollution in zipObjectDeep function

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

CVSS 3.1 · 7.4 High EPSS 5.2% KEV · Not listed

Vendors

Lodash Oracle Redhat

Products

Lodash Banking Corporate Lending Process Management Banking Credit Facilities Process Management and 21 more

CVE-2020-10531

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 6 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2021-23337

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS 3.1 · 7.2 High EPSS 20.2% KEV · Not listed

Vendors

Lodash Netapp Oracle and 2 more

Products

Lodash Active Iq Unified Manager Cloud Manager and 26 more

CVE-2020-28500

Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVSS 3.1 · 5.3 Medium EPSS 7.4% KEV · Not listed

Vendors

Lodash Oracle Redhat and 1 more

Products

Lodash Banking Corporate Lending Process Management Banking Credit Facilities Process Management and 22 more

CVE-2020-36188

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

CVSS 3.1 · 8.1 High EPSS 8.8% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 44 more

CVE-2020-36187

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 44 more

CVE-2020-36186

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 44 more

CVE-2020-36185

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 44 more

CVE-2020-36183

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

CVSS 3.1 · 8.1 High EPSS 5.0% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 44 more

CVE-2020-36182

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 58 more

CVE-2020-36184

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

CVSS 3.1 · 8.8 High EPSS 8.4% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 58 more

CVE-2020-36181

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Service Level Manager and 57 more

CVE-2020-36180

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Cloud Backup and 58 more

CVE-2020-35728

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

CVSS 3.1 · 8.1 High EPSS 12.5% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Service Level Manager and 39 more

CVE-2020-11080

Denial of service in nghttp2

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

CVSS 3.1 · 3.7 Low EPSS 5.3% KEV · Not listed

Vendors

Debian Fedoraproject Nghttp2 and 4 more

Products

Debian Linux Fedora Nghttp2 and 13 more

CVE-2020-28052

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

CVSS 3.1 · 8.1 High EPSS 7.2% KEV · Not listed

Vendors

Apache Bouncycastle Oracle and 1 more

Products

Karaf Bc-java Banking Corporate Lending Process Management and 24 more

CVE-2020-8174

nodejs: memory corruption in napi_get_value_string_* functions

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

CVSS 3.1 · 8.1 High EPSS 7.6% KEV · Not listed

Vendors

Netapp Nodejs Oracle and 1 more

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 10 more

CVE-2020-8172

nodejs: TLS session reuse can lead to hostname verification bypass

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

CVSS 3.1 · 7.4 High EPSS 6.1% KEV · Not listed

Vendors

Nodejs Oracle Redhat

Products

Node.js Banking Extensibility Workbench Blockchain Platform and 5 more

CVE-2020-15824

kotlin: kotlin-main-kts cached scripts in the system temp directory could result in priviledge escalation

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Jetbrains Oracle

Products

Kotlin Banking Extensibility Workbench Communications Cloud Native Core Policy

CVE-2019-10744

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 3.1 · 9.1 Critical EPSS 5.0% KEV · Not listed

Vendors

F5 Lodash Netapp and 2 more

Products

Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 23 more