{"vulnerability": "CVE-2020-2844", "sightings": [{"uuid": "5e03fcba-d432-4211-a132-c06008adac90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28441", "type": "seen", "source": "https://t.me/cibsecurity/46908", "content": "\u203c CVE-2020-28441 \u203c\n\nThis affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-25T18:33:08.000000Z"}, {"uuid": "947f29f1-438f-4dd5-a018-2116a273fc0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28446", "type": "seen", "source": "https://t.me/cibsecurity/46919", "content": "\u203c CVE-2020-28446 \u203c\n\nThe package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-25T18:33:22.000000Z"}, {"uuid": "fdcea5ab-7253-4ddf-af36-95b218b9c171", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28445", "type": "seen", "source": "https://t.me/cibsecurity/46928", "content": "\u203c CVE-2020-28445 \u203c\n\nThis affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-07-25T18:39:11.000000Z"}, {"uuid": "34bb0efa-fbfb-48d6-a729-8d1c2565e33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28449", "type": "seen", "source": "https://t.me/cibsecurity/23068", "content": "\u203c CVE-2020-28449 \u203c\n\nThis affects all versions of package decal. The vulnerability is in the set function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-04T18:34:13.000000Z"}, {"uuid": "9f0c1a4e-b5c1-4f0f-bd4e-2097f4edacf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28448", "type": "seen", "source": "https://t.me/cibsecurity/21156", "content": "\u203c CVE-2020-28448 \u203c\n\nThis affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-22T16:53:00.000000Z"}, {"uuid": "cfe53e08-be87-429c-ae33-bd5c825bace6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28448", "type": "seen", "source": "https://t.me/cibsecurity/21155", "content": "\u203c CVE-2020-28460 \u203c\n\nThis affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-22T16:52:59.000000Z"}, {"uuid": "39cc823c-60d9-455f-a1a8-9203e4e3c617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20458", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T22:25:20.000000Z"}, {"uuid": "4271f96d-25ec-4fd6-b04e-6ab13f7919bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20400", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T21:25:19.000000Z"}, {"uuid": "58f1f6d4-9976-4ef6-8fbe-08af51a69726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20438", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T22:10:50.000000Z"}, {"uuid": "a94eeac2-0c6b-4c99-a5df-15101105ec12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20381", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T20:46:05.000000Z"}, {"uuid": "49a1cd97-d239-4d9c-b6ae-3784b2e79ce2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20418", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T22:04:39.000000Z"}, {"uuid": "9d13a7bd-78e3-45f0-9252-0e47a68a0a92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28440", "type": "seen", "source": "https://t.me/cibsecurity/20361", "content": "\u203c CVE-2020-28440 \u203c\n\nAll versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-11T20:35:47.000000Z"}, {"uuid": "d29939c5-3183-4410-8e0e-64046206bb92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2020-28449", "type": "seen", "source": "https://t.me/makrushin/183", "content": "", "creation_timestamp": "2026-07-17T10:00:04.658708Z"}, {"uuid": "c8d16ccb-8b27-4a3c-afca-3d1f1b489c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2020-28449", "type": "seen", "source": "https://t.me/makrushin/183", "content": "", "creation_timestamp": "2026-07-18T00:00:26.818709Z"}]}