From 32261b23b893bdc3b1a9eaf75ed4411aeb637d5a Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 30 Mar 2021 23:00:44 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2016/10xxx/CVE-2016-10703.json | 5 +++++ 2017/14xxx/CVE-2017-14077.json | 5 +++++ 2019/17xxx/CVE-2019-17564.json | 5 +++++ 2020/36xxx/CVE-2020-36284.json | 18 ++++++++++++++++++ 2020/36xxx/CVE-2020-36285.json | 18 ++++++++++++++++++ 2020/6xxx/CVE-2020-6816.json | 5 +++++ 2021/21xxx/CVE-2021-21413.json | 2 +- 7 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 2020/36xxx/CVE-2020-36284.json create mode 100644 2020/36xxx/CVE-2020-36285.json diff --git a/2016/10xxx/CVE-2016-10703.json b/2016/10xxx/CVE-2016-10703.json index 34ce13d19dc..48d04845b7f 100644 --- a/2016/10xxx/CVE-2016-10703.json +++ b/2016/10xxx/CVE-2016-10703.json @@ -61,6 +61,11 @@ "name": "https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01", "refsource": "MISC", "url": "https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01" + }, + { + "refsource": "MISC", + "name": "https://advisory.checkmarx.net/advisory/CX-2016-4450", + "url": "https://advisory.checkmarx.net/advisory/CX-2016-4450" } ] } diff --git a/2017/14xxx/CVE-2017-14077.json b/2017/14xxx/CVE-2017-14077.json index d1854a7d9c3..384af5b322d 100644 --- a/2017/14xxx/CVE-2017-14077.json +++ b/2017/14xxx/CVE-2017-14077.json @@ -56,6 +56,11 @@ "name": "https://www.checkmarx.com/advisories/html-injection-securimage/", "refsource": "MISC", "url": "https://www.checkmarx.com/advisories/html-injection-securimage/" + }, + { + "refsource": "MISC", + "name": "https://advisory.checkmarx.net/advisory/CX-2017-4223", + "url": "https://advisory.checkmarx.net/advisory/CX-2017-4223" } ] } diff --git a/2019/17xxx/CVE-2019-17564.json b/2019/17xxx/CVE-2019-17564.json index 7ef9af926be..de984765afa 100644 --- a/2019/17xxx/CVE-2019-17564.json +++ b/2019/17xxx/CVE-2019-17564.json @@ -54,6 +54,11 @@ "refsource": "MISC", "name": "https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E", "url": "https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E" + }, + { + "refsource": "MISC", + "name": "https://advisory.checkmarx.net/advisory/CX-2020-4275", + "url": "https://advisory.checkmarx.net/advisory/CX-2020-4275" } ] }, diff --git a/2020/36xxx/CVE-2020-36284.json b/2020/36xxx/CVE-2020-36284.json new file mode 100644 index 00000000000..8015b184778 --- /dev/null +++ b/2020/36xxx/CVE-2020-36284.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-36284", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2020/36xxx/CVE-2020-36285.json b/2020/36xxx/CVE-2020-36285.json new file mode 100644 index 00000000000..d07849f3424 --- /dev/null +++ b/2020/36xxx/CVE-2020-36285.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-36285", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2020/6xxx/CVE-2020-6816.json b/2020/6xxx/CVE-2020-6816.json index f587cbb4926..5422953ea6b 100644 --- a/2020/6xxx/CVE-2020-6816.json +++ b/2020/6xxx/CVE-2020-6816.json @@ -58,6 +58,11 @@ "refsource": "FEDORA", "name": "FEDORA-2020-e0f35d634c", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EDQU2SZLZMSSACCBUBJ6NOSRNNBDYFW5/" + }, + { + "refsource": "MISC", + "name": "https://advisory.checkmarx.net/advisory/CX-2020-4277", + "url": "https://advisory.checkmarx.net/advisory/CX-2020-4277" } ] }, diff --git a/2021/21xxx/CVE-2021-21413.json b/2021/21xxx/CVE-2021-21413.json index 6d60ab1f423..9064fa066c2 100644 --- a/2021/21xxx/CVE-2021-21413.json +++ b/2021/21xxx/CVE-2021-21413.json @@ -35,7 +35,7 @@ "description_data": [ { "lang": "eng", - "value": "isolated-vm is a library for nodejs which gives you access to v8's Isolate interface.\nVersions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate.\n\nReference objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a Reference instance to an attacker they would be able to use it to acquire a Reference to the nodejs context's Function object.\n\nSimilar application-specific attacks could be possible by modifying the local prototype of other API objects.\n\nAccess to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution.\n\nThis is addressed in v4.0.0 through a series of related changes." + "value": "isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a Reference instance to an attacker they would be able to use it to acquire a Reference to the nodejs context's Function object. Similar application-specific attacks could be possible by modifying the local prototype of other API objects. Access to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution. This is addressed in v4.0.0 through a series of related changes." } ] },