Approved changes feed: RSS · Atom
cpe:2.3:a:n/a:total.js:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | N/A (22f567d3-1203-528c-8f0e-3eb9c2f6ca78) |
|---|---|
| Product | Total.Js (ed641a9b-465a-5380-b737-c6630d4e7b3e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-23389 |
vulnerable | 2026-06-08 05:30:02.841034 |
Arbitrary Code Execution
CRITICAL (9.8)
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Published: 2021-07-12T15:15:18.459Z
Updated: 2024-09-16T18:33:56.688Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-23344 |
vulnerable | 2026-06-08 05:30:02.743532 |
Remote Code Execution (RCE)
CRITICAL (9.8)
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Published: 2021-03-04T16:55:14.189Z
Updated: 2024-09-17T01:55:53.280Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28495 |
vulnerable | 2026-06-08 05:23:56.174162 |
Prototype Pollution
HIGH (7.3)
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Published: 2021-02-02T10:25:17.752Z
Updated: 2024-09-16T22:40:43.106Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28494 |
vulnerable | 2026-06-08 05:23:56.172433 |
Command Injection
HIGH (8.6)
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Published: 2021-02-02T10:25:22.372Z
Updated: 2024-09-16T16:33:03.828Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.