Prototype Pollution in y18n

🗓️ 29 Mar 2021 16:05:12Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 62 Views

npm package y18n vulnerabilit

Reporter	Title	Published	Views	Family All 213
Huntr	Prototype Pollution in yargs/y18n	15 Oct 202000:00	–	huntr
IBM Security Bulletins	Security Bulletin: CVE-2020-7774	8 Jul 202219:05	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM App Connect Enterprise and IBM Integration Bus (CVE-2020-7774)	28 Jun 202217:08	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202319:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affects IBM Netcool Agile Service Manager	1 Jun 202213:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	16 Aug 202215:59	–	ibm
IBM Security Bulletins	Security Bulletin: Potential vulnerability with Node.js	30 Jul 202121:10	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js y18n module affects IBM Cloud Automation Manager.	17 Feb 202116:46	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	25 Jun 202108:42	–	ibm

Vulners

Node

y18n_project y18nRange5.0.0–5.0.5npm

OR

y18n_project y18nMatch4.0.0npm

OR

y18n_project y18nRange<3.2.2npm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-7774
github	www.github.com/yargs/y18n/issues/96
github	www.github.com/yargs/y18n/pull/108
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
snyk	www.snyk.io/vuln/SNYK-JS-Y18N-1021887
github	www.github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25
oracle	www.oracle.com/security-alerts/cpuApr2021.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
github	www.github.com/yargs/y18n/commit/90401eea9062ad498f4f792e3fff8008c4c193a3
github	www.github.com/advisories/GHSA-c4w7-xm78-47vh

29 Nov 2023 22:45Current

8.4High risk

Vulners AI Score8.4

CVSS 27.5

CVSS 3.17.3 - 9.8

EPSS0.69062

CWE-20 CWE-915 CWE-1321

prototype pollution npm package y18n upgrade vulnerable version