CVE-2020-28501

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
n/aes6-crawler-detect>= unspecified, < 3.1.3

References

Timeline

Published
Mar 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-285028.1This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that arCVE-2020-28534.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected arCVE-2020-28548.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-28558.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Admin). Supported versions that are affected are 12.1.1-CVE-2020-28568.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-28578.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions tCVE-2020-285727.8A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additionCVE-2020-285735.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedCVE-2020-285747.5A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow
CVE-2020-28501: High severity, CVSS 7.5 | Vulnix