From b8c9c2b31baab64d9806688205e7b29b481af3b4 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 2 Feb 2021 11:00:42 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2019/20xxx/CVE-2019-20838.json | 5 +++++ 2020/14xxx/CVE-2020-14155.json | 5 +++++ 2020/15xxx/CVE-2020-15358.json | 5 +++++ 2020/27xxx/CVE-2020-27904.json | 5 +++++ 2020/28xxx/CVE-2020-28494.json | 12 +++++++----- 2020/28xxx/CVE-2020-28495.json | 27 ++++++++++++++++----------- 2021/26xxx/CVE-2021-26559.json | 18 ++++++++++++++++++ 7 files changed, 61 insertions(+), 16 deletions(-) create mode 100644 2021/26xxx/CVE-2021-26559.json diff --git a/2019/20xxx/CVE-2019-20838.json b/2019/20xxx/CVE-2019-20838.json index 07e0d1d1a31..8c821bc22d7 100644 --- a/2019/20xxx/CVE-2019-20838.json +++ b/2019/20xxx/CVE-2019-20838.json @@ -76,6 +76,11 @@ "refsource": "CONFIRM", "name": "https://support.apple.com/kb/HT212147", "url": "https://support.apple.com/kb/HT212147" + }, + { + "refsource": "FULLDISC", + "name": "20210201 APPLE-SA-2021-02-01-1 macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave", + "url": "http://seclists.org/fulldisclosure/2021/Feb/14" } ] } diff --git a/2020/14xxx/CVE-2020-14155.json b/2020/14xxx/CVE-2020-14155.json index 0d5a91b24eb..44bd159d04a 100644 --- a/2020/14xxx/CVE-2020-14155.json +++ b/2020/14xxx/CVE-2020-14155.json @@ -81,6 +81,11 @@ "refsource": "CONFIRM", "name": "https://support.apple.com/kb/HT212147", "url": "https://support.apple.com/kb/HT212147" + }, + { + "refsource": "FULLDISC", + "name": "20210201 APPLE-SA-2021-02-01-1 macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave", + "url": "http://seclists.org/fulldisclosure/2021/Feb/14" } ] } diff --git a/2020/15xxx/CVE-2020-15358.json b/2020/15xxx/CVE-2020-15358.json index d1ce4e96bd4..5e2324f67d9 100644 --- a/2020/15xxx/CVE-2020-15358.json +++ b/2020/15xxx/CVE-2020-15358.json @@ -141,6 +141,11 @@ "refsource": "CONFIRM", "name": "https://support.apple.com/kb/HT212147", "url": "https://support.apple.com/kb/HT212147" + }, + { + "refsource": "FULLDISC", + "name": "20210201 APPLE-SA-2021-02-01-1 macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave", + "url": "http://seclists.org/fulldisclosure/2021/Feb/14" } ] } diff --git a/2020/27xxx/CVE-2020-27904.json b/2020/27xxx/CVE-2020-27904.json index 44d425a0bfe..0336f06fef9 100644 --- a/2020/27xxx/CVE-2020-27904.json +++ b/2020/27xxx/CVE-2020-27904.json @@ -59,6 +59,11 @@ "refsource": "CONFIRM", "name": "https://support.apple.com/kb/HT212147", "url": "https://support.apple.com/kb/HT212147" + }, + { + "refsource": "FULLDISC", + "name": "20210201 APPLE-SA-2021-02-01-1 macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave", + "url": "http://seclists.org/fulldisclosure/2021/Feb/14" } ] }, diff --git a/2020/28xxx/CVE-2020-28494.json b/2020/28xxx/CVE-2020-28494.json index d4e84430faa..bb1fa9446c2 100644 --- a/2020/28xxx/CVE-2020-28494.json +++ b/2020/28xxx/CVE-2020-28494.json @@ -48,12 +48,14 @@ "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672" + "refsource": "MISC", + "url": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672", + "name": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672" }, { - "refsource": "CONFIRM", - "url": "https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5" + "refsource": "MISC", + "url": "https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5", + "name": "https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5" } ] }, @@ -61,7 +63,7 @@ "description_data": [ { "lang": "eng", - "value": "This affects the package total.js before 3.4.7.\n The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.\r\n\r\n" + "value": "This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized." } ] }, diff --git a/2020/28xxx/CVE-2020-28495.json b/2020/28xxx/CVE-2020-28495.json index e61545083e6..34a653e94de 100644 --- a/2020/28xxx/CVE-2020-28495.json +++ b/2020/28xxx/CVE-2020-28495.json @@ -48,24 +48,29 @@ "references": { "reference_data": [ { - "refsource": "CONFIRM", - "url": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671" + "refsource": "MISC", + "url": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671", + "name": "https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671" }, { - "refsource": "CONFIRM", - "url": "https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set" + "refsource": "MISC", + "url": "https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set", + "name": "https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set" }, { - "refsource": "CONFIRM", - "url": "https://github.com/totaljs/framework/blob/master/utils.js%23L6606" + "refsource": "MISC", + "url": "https://github.com/totaljs/framework/blob/master/utils.js%23L6606", + "name": "https://github.com/totaljs/framework/blob/master/utils.js%23L6606" }, { - "refsource": "CONFIRM", - "url": "https://github.com/totaljs/framework/blob/master/utils.js%23L6617" + "refsource": "MISC", + "url": "https://github.com/totaljs/framework/blob/master/utils.js%23L6617", + "name": "https://github.com/totaljs/framework/blob/master/utils.js%23L6617" }, { - "refsource": "CONFIRM", - "url": "https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff" + "refsource": "MISC", + "url": "https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff", + "name": "https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff" } ] }, @@ -73,7 +78,7 @@ "description_data": [ { "lang": "eng", - "value": "This affects the package total.js before 3.4.7.\n The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection. \r\n\r\n" + "value": "This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection." } ] }, diff --git a/2021/26xxx/CVE-2021-26559.json b/2021/26xxx/CVE-2021-26559.json new file mode 100644 index 00000000000..3fac8d1f747 --- /dev/null +++ b/2021/26xxx/CVE-2021-26559.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2021-26559", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file