Medium
CVE-2020-28459
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2022-36127
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
Critical
CVE-2020-7677
thenify before 3.3.1 made use of unsafe calls to `eval`.
Medium
CVE-2022-31160
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
High
CVE-2021-35065
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
High
CVE-2020-7641
grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload
Medium
CVE-2022-25869
Angular (deprecated package) Cross-site Scripting
Critical
CVE-2022-31180
Shescape vulnerable to insufficient escaping of whitespace
High
CVE-2022-31179
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
High
CVE-2022-31142
fastify-bearer-auth vulnerable to Timing Attack Vector
Critical
CVE-2022-32214
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
Critical
CVE-2022-32213
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
High
CVE-2019-10761
vm2 before 3.6.11 vulnerable to sandbox escape
Medium
CVE-2022-32114
Strapi 4.1.12 Cross-site Scripting via crafted file
Low
CVE-2022-25858
terser (JS Package) < 5.14.2 - Denial of Service
Medium
CVE-2022-25875
Svelte vulnerable to XSS when using objects during server-side rendering
High
CVE-2022-31112
Protected fields exposed via LiveQuery
High
CVE-2022-31127
Improper handling of email input
High
CVE-2022-31129
Moment.js vulnerable to Inefficient Regular Expression Complexity
High
CVE-2022-31147
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method
Medium
CVE-2022-31108
Possible inject arbitrary `CSS` into the generated graph affecting the container HTML
Critical
CVE-2022-33171
SQL injection in typeORM
Medium
CVE-2022-25896
Passport vulnerable to session regeneration when a users logs in or out
Medium
CVE-2022-25876
Server-Side Request Forgery in link-preview-js
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.