cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2022-0451,https://securityvulnerability.io/vulnerability/CVE-2022-0451,Auth bypass in Dark SDK,"Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.",Google,Dart Sdk,6.5,MEDIUM,0.0005600000149570405,false,false,false,false,,false,false,2022-02-03T00:00:00.000Z,0
CVE-2021-22567,https://securityvulnerability.io/vulnerability/CVE-2021-22567,Bidirectional Override in Dart SDK,Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways.,Google,Dart Sdk,4.6,MEDIUM,0.0005000000237487257,false,false,false,false,,false,false,2022-01-05T11:15:00.000Z,0
CVE-2021-22568,https://securityvulnerability.io/vulnerability/CVE-2021-22568,Dart - Publishing to third-party package repositories may expose pub.dev credentials,"When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0",Google,Dart Sdk,8.8,HIGH,0.0014700000174343586,false,false,false,false,,false,false,2021-12-09T17:05:12.000Z,0
CVE-2021-22540,https://securityvulnerability.io/vulnerability/CVE-2021-22540,XSS in Dart SDK,Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.,Google,Dart Sdk,6.1,MEDIUM,0.0006399999838322401,false,false,false,false,,false,false,2021-04-22T14:15:17.000Z,0
CVE-2020-8923,https://securityvulnerability.io/vulnerability/CVE-2020-8923,XSS in Dart,"An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.",Google,Dart Sdk,5.4,MEDIUM,0.0006200000061653554,false,false,false,false,,false,false,2020-03-26T11:31:55.000Z,0