Node.js third-party modules: Prototype pollution in dot-prop

🗓️ 22 Oct 2019 12:06:11Reported by aaron_costelloType

Node.js third-party modules: Prototype pollution in dot-prop. Parameter pollution allows attacker to modify prototype, leading to DoS, data access, RCE

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System	17 Aug 202209:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: OSS security Scan issues for Concerto installer.	8 Dec 202006:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Applications 4.3 nodejs and nodejs-express Appsody stacks is vulnerable to information disclosure, buffer overflow and prototype pollution exposures	8 Jun 202100:42	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Security issues for NPS console.	15 Dec 202007:03	–	ibm
IBM Security Bulletins	Security Bulletin: OSS scan fixes for Content pos	15 Dec 202006:58	–	ibm
AlmaLinux	Moderate: nodejs:12 security and bug fix update	19 Oct 202007:13	–	almalinux
AlmaLinux	Moderate: nodejs:10 security update	16 Feb 202107:34	–	almalinux
BDU FSTEC	The vulnerability of the dot-prop library in application software, Aurora Center, arises from uncontrolled changes to object prototypes’ attributes. This allows attackers to execute “prototype pollution” attacks.	9 Jun 202100:00	–	bdu_fstec

28 Jan 2020 10:17Current

0.3Low risk

Vulners AI Score0.3

EPSS0.00764