Vulnerabilities

TI-2021-21541 CVE-2021-46872 · GHSA-6fm4-9v93-v7gg

An issue was discovered in Nim before 1.6.2.

LOW 28

An issue was discovered in Nim before 1.6.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00562 Published 2023-01-13 No fix listed CWE-79

TI-2022-07655 CVE-2022-23602

Nim's rst parser sandboxed mode allows include which can embed any local file

HIGH 68

Nimforum is a lightweight alternative to Discourse written in Nim.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01343 Published 2022-02-01 No fix listed CWE-22

TI-2020-14473 CVE-2020-23171 · GHSA-3phc-v747-949q

A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write…

LOW 26

A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00656 Published 2021-08-10 No fix listed CWE-610

TI-2021-10206 CVE-2021-29495

Nim stdlib httpClient does not validate peer certificates by default

LOW 33

Nim is a statically typed compiled systems programming language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2021-05-07 Fixed in 1.4.2 CWE-295

TI-2021-04472 CVE-2021-21373

Nimble falls back to insecure http url when fetching packages

LOW 35

Nimble is a package manager for the Nim programming language.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01155 Published 2021-03-26 Fixed in 1.2.10, 1.4.4 CWE-348

TI-2021-04473 CVE-2021-21374

Nimble fails to validate certificates due to insecure httpClient defaults

LOW 37

Nimble is a package manager for the Nim programming language.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0104 Published 2021-03-26 Fixed in 1.2.10, 1.4.4 CWE-348

TI-2021-04471 CVE-2021-21372

Nimble arbitrary code execution for specially crafted package metadata

MEDIUM 44

Nimble is a package manager for the Nim programming language.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03618 Published 2021-03-26 Fixed in 1.2.10, 1.4.4 CWE-20

TI-2020-12363 CVE-2020-15690

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a…

MEDIUM 48

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03219 Published 2021-01-30 No fix listed CWE-74

TI-2020-12366 CVE-2020-15694 · GHSA-mwjr-9xqh-r2f5

In Nim 1.2.4, the standard library httpClient fails to properly validate the server…

LOW 37

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02331 Published 2020-08-14 No fix listed CWE-20

TI-2020-12365 CVE-2020-15693

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the…

LOW 33

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02131 Published 2020-08-14 No fix listed CWE-74

TI-2020-12364 CVE-2020-15692

In Nim 1.2.4, the standard library browsers mishandles the URL argument to…

MEDIUM 49

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04205 Published 2020-08-14 No fix listed CWE-88

Vulnerabilities

Filters