Nim-lang Nim
9 CVEs affecting Nim-lang Nim. Latest disclosed: 2023-01-13. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15690 | Critical | 9.8 | 2021-01-30 | In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character. |
CVE-2020-15692 | Critical | 9.8 | 2020-08-14 | In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be ope… |
CVE-2021-21372 | High | 8.3 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places… |
CVE-2021-21374 | High | 8.1 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2021-21373 | High | 7.5 | 2021-03-26 | Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimb… |
CVE-2020-15694 | High | 7.5 | 2020-08-14 | In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any… |
CVE-2020-15693 | Medium | 6.5 | 2020-08-14 | In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part… |
CVE-2021-46872 | Medium | 6.1 | 2023-01-13 | An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI sch… |
CVE-2021-29495 | Medium | 5.9 | 2021-05-07 | Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled… |