CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2021-23664 – Server-side Request Forgery (SSRF)
https://notcve.org/view.php?id=CVE-2021-23664
The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js. El paquete @isomorphic-git/cors-proxy versiones anteriores a 2.7.1 es vulnerable a un ataque de tipo Server-side Request Forgery (SSRF) debido a una falta de saneo y comprobación de la acción de redireccionamiento en middleware.js • https://github.com/isomorphic-git/cors-proxy/commit/1b1c91e71d946544d97ccc7cf0ac62b859e03311 https://snyk.io/vuln/SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30483 – isomorphic-git: Directory traversal via a crafted repository
https://notcve.org/view.php?id=CVE-2021-30483
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. isomorphic-git versiones anteriores a 1.8.2, permite un Salto de Directorio por medio de un repositorio diseñado A flaw was found in isomorphic-git. An attacker could cause a Directory Traversal via a crafted filepath in a repository being cloned. • https://github.com/isomorphic-git/isomorphic-git/pull/1339 https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.8.2 https://vuln.ryotak.me/advisories/28 https://access.redhat.com/security/cve/CVE-2021-30483 https://bugzilla.redhat.com/show_bug.cgi?id=1988539 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •