580
VMScore

CVE-2021-23337

Published: 15/02/2021 Updated: 13/09/2022
CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
VMScore: 580
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Vulnerability Summary

Lodash versions before 4.17.21 are vulnerable to Command Injection via the template function.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

lodash lodash

oracle primavera unifier 18.8

oracle primavera unifier

oracle peoplesoft enterprise peopletools 8.58

oracle primavera unifier 19.12

oracle retail customer management and segmentation foundation 19.0

oracle communications services gatekeeper 7.0

oracle enterprise communications broker 3.2.0

oracle primavera unifier 20.12

oracle banking extensibility workbench 14.3.0

oracle banking trade finance process management 14.3.0

oracle banking credit facilities process management 14.3.0

oracle banking corporate lending process management 14.3.0

oracle peoplesoft enterprise peopletools 8.59

oracle primavera gateway

oracle communications session border controller 8.4

oracle communications session border controller 9.0

oracle banking supply chain finance 14.2.0

oracle banking trade finance process management 14.5.0

oracle banking credit facilities process management 14.2.0

oracle banking credit facilities process management 14.5.0

oracle banking corporate lending process management 14.2.0

oracle banking corporate lending process management 14.5.0

oracle banking supply chain finance 14.5.0

oracle banking supply chain finance 14.3.0

oracle banking trade finance process management 14.2.0

oracle banking extensibility workbench 14.2.0

oracle banking extensibility workbench 14.5.0

oracle enterprise communications broker 3.3.0

oracle communications design studio 7.4.2.0.0

oracle communications cloud native core policy 1.11.0

oracle communications cloud native core binding support function 1.9.0

oracle jd edwards enterpriseone tools

oracle financial services crime and compliance management studio 8.0.8.3.0

oracle health sciences data management workbench 2.5.2.1

oracle health sciences data management workbench 3.0.0.0

oracle financial services crime and compliance management studio 8.0.8.2.0

netapp active iq unified manager -

netapp cloud manager -

netapp system manager 9.0

siemens sinec ins 1.0

siemens sinec ins

Vendor Advisories

Synopsis Important: Migration Toolkit for Containers (MTC) 174 security and bug fix update Type/Severity Security Advisory: Important Topic The Migration Toolkit for Containers (MTC) 174 is now availableRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ba ...
Debian Bug report logs - #985086 CVE-2021-23337 CVE-2020-28500 Package: node-lodash; Maintainer for node-lodash is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Source for node-lodash is src:node-lodash (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 1 ...

ICS Advisories

Github Repositories

Generates a express restfull application with the mysql connection

Generator Express Restful MySQL Generates a express restful application with the mysql connection It use the EM2015 Javascript This is a Yeoman Generator generates a scaffolding for an application with a restful interface with express and mysql Looking for the generator for ES5? The branch "generator-0-7" find here githubcom/blueskyfish/generator-expres

This example shows how to implement the Elektron WebSocket API JavaScript web application with TypeScript.

Websocket API for Pricing Streaming and Real-Time Service with TypeScript Example Overview Example Code Disclaimer: ALL EXAMPLE CODE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS FOR ILLUSTRATIVE PURPOSES ONLY REFINITIV MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF THE EXAMPLE CODE, OR THE INFORMATIO

launchqtcreator README QtCreator is very useful for certain tasks! When working on Qt projects, there are things I find Qt Creator invaluable for -just too convenient to use anything else (almost) I often use Visual Studio Code and QtCreator together when working on c++/gui projects

blank The following is an example of how one might display errors/warnings in the build where lodashtemplate is used due to the unresolved CVE /*eslint no-restricted-imports: ["error", { paths: [{ name: "lodash", importNames: ["template"], message: "Importing 'lodashtemplate' from 'lodash' is not allo

Frogbot Demo The Defined Watch From My Jfrog Platform Deployment (JPD) { "general_data": { "id": "73edfa9015f68719bad22177", "name": "frogbot-test-watch", <--------- "active": true }, "project_resources": { "resources": [ { "type": "all-builds", &quo

A sample application with known vulnerabilities - JavaScript, Express

A sample application with known vulnerabilities - JavaScript, Express A sample application with known issues for testing various linters, scanners, and scan automation This project uses: Component In Use Platform NodeJS Language(s) JavaScript (ECMAScript) Build npm Framework Express Security issues Vulnerability Type Description Location PoC Command Cros

This example shows how to implement the Elektron WebSocket API JavaScript web application with TypeScript.

Websocket API for Pricing Streaming and Real-Time Service with TypeScript Example Overview Example Code Disclaimer: ALL EXAMPLE CODE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS FOR ILLUSTRATIVE PURPOSES ONLY REFINITIV MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF THE EXAMPLE CODE, OR THE INFORMATIO

A tool to analyse the list of detected CVEs in the containers (usually created by static security scanner) and compare them to the Red Hat Security Data.

cve-analyser A tool to analyse the list of detected CVEs in the containers (usually created by security scanner like JFrog, Aqua, Sysdig or similar) and compare them to the Red Hat Security Data The cve-analyser can find fixes in the rpm packages bundled in the specified container, as well as the fixes in the non-rpm content (like nodejs libraries) Usage To use this tool just