{"metadata": {"vulnerability": "CVE-2020-37282", "count": 13, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2020-09-02T00:00:00Z", "date_only": false, "value": "2020-09-02T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2020-37282", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:16.238Z", "date_only": false, "value": "2026-10-14T13:07:16.238Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2020-37282", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:16:28.862Z", "date_only": false, "value": "2026-10-14T14:16:28.862Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2020-37282", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:16:28.862Z", "date_only": false, "value": "2026-10-14T14:16:28.862Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2020-37282", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:16:28.862Z", "date_only": false, "value": "2026-10-14T14:16:28.862Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2020-37282", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:16:59Z", "date_only": false, "value": "2026-10-14T15:16:59Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-869R-FXQ2-Q8QX", "record": "GHSA-869R-FXQ2-Q8QX", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:16:59.520Z", "date_only": false, "value": "2026-10-14T15:16:59.520", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-37282", "record": "FKIE_CVE-2020-37282", "field": "published"}, {"timestamp": "2026-10-14T15:30:05.106Z", "date_only": false, "value": "2026-10-14T15:30:05.106324Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtuhizzr624", "record": "CVE-2020-37282", "field": "creation_timestamp", "uuid": "9ba3cab2-6b22-4b46-8079-89edfb7d98b9", "content": "CVE-2020-37282 - office-converter\nThe office-converter library (versions up to 1.0.2) runs a system conversion tool using the file name you provide. If a specially crafted name is used, it can cause\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#officeconverter #vworld4u #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtuhizzr624"}, {"timestamp": "2026-10-14T15:32:22Z", "date_only": false, "value": "2026-10-14T15:32:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-869R-FXQ2-Q8QX", "record": "GHSA-869R-FXQ2-Q8QX", "field": "published"}, {"timestamp": "2026-10-14T15:32:22Z", "date_only": false, "value": "2026-10-14T15:32:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-869R-FXQ2-Q8QX", "record": "GHSA-869R-FXQ2-Q8QX", "field": "modified"}, {"timestamp": "2026-10-14T16:07:54.354Z", "date_only": false, "value": "2026-10-14T16:07:54.354039Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwl5daam24", "record": "CVE-2020-37282", "field": "creation_timestamp", "uuid": "69fd7a18-b942-4768-8512-39c2a4f3f13b", "content": "\ud83d\udea8 CVE-2020-37282 \u2014 CVSS 9.3 CRITICAL\n\noffice-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to exec...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2020-37282\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwl5daam24"}, {"timestamp": "2026-10-14T19:01:46.801Z", "date_only": false, "value": "2026-10-14T19:01:46.801954Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440807323407184", "record": "CVE-2020-37282", "field": "creation_timestamp", "uuid": "87af51ec-94d3-4a3b-b8c5-080281ad602a", "content": "CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2020-37282https://github.com/advisories/GHSA-9p64-h5q4-phpmhttps://github.com/vworld4u/office-converter/pull/9https://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20https://www.vulncheck.com/advisories/office-converter-through-1.0.2-os-command-injection-via-filename-in-generatepdf#vworld4u #office-converter#CVE_2020_37282#bot", "url": "https://infosec.exchange/users/cve/statuses/117440807323407184"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-37282", "record": "FKIE_CVE-2020-37282", "field": "lastModified"}]}