Prototype Pollution in set-value

🗓️ 13 Sep 2021 20:09:36Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 85 Views

Prototype Pollution vulnerability in set-valu

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	30 Nov 202116:26	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2022-25881, CVE-2021-23440, CVE-2022-24785, CVE-2022-46175)	6 Jun 202320:02	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in module set-value affects IBM Db2 Big SQL on Cloud Pak for Data	23 Dec 202514:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards may be vulnerable to arbitrary code execution via CVE-2021-23440	20 Sep 202111:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components	19 Jan 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found with third-party libraries used by IBM® MobileFirst Platform	17 Feb 202315:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in React, webpack and Node.js modules affect Tivoli Netcool/OMNIbus WebGUI	6 Oct 202204:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	31 Aug 202310:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may vulnerable to denial of service, spoofing attacks via dependent JavaScript libraries (CVE-2021-23440, CVE-2018-25031, CVE-2022-46175, CVE-2022-37599, CVE-2022-37603)	29 Aug 202321:45	–	ibm

Vulners

Node

set-value_project set-valueRange3.0.0–3.0.3npm

OR

set-value_project set-valueRange4.0.0–4.0.1npm

OR

set-value_project set-valueRange<2.0.1npm

OR

set-value-nugetRange<2.0.0nuget

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-23440
github	www.github.com/jonschlinkert/set-value/pull/33
github	www.github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212
snyk	www.snyk.io/vuln/SNYK-JS-SETVALUE-1540541
huntr	www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
oracle	www.oracle.com/security-alerts/cpujan2022.html
github	www.github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a
github	www.github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad
github	www.github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245

03 Nov 2023 20:25Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.17.3 - 9.8

EPSS0.00064

CWE-843 CWE-1321

set-value prototype pollution type confusion cve-2019-10747 user-provided keys arrays