CVE-2020-28464

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jan 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284667.5This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs thCVE-2020-284689.8This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side CVE-2020-284697.5This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separatCVE-2020-28478.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284706.1This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then writtenCVE-2020-284719.8This affects the package properties-reader before 2.2.0.CVE-2020-284729.8This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malCVE-2020-284736.8The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attCVE-2020-284777.5This affects all versions of package immer.CVE-2020-284787.5This affects the package gsap before 3.6.0.CVE-2020-284797.5The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.CVE-2020-28488.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions tha