Node.js third-party modules: SQL Injection or Denial of Service due to a Prototype Pollution

🗓️ 09 May 2020 14:16:59Reported by phraType

hackerone

hackerone🔗 hackerone.com👁 28 Views

Security vulnerability in TypeORM package. Allows prototype pollution leading to SQL injection or denial of service attacks

Reporter	Title	Published	Views	Family All 19
IBM Security Bulletins	Security Bulletin: Node.js upgrade for IBM Cloud Pak for Data Streams Flows	30 Nov 202016:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple Node.js vulnerabilities	15 Jan 202114:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	9 Dec 202004:41	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Node.js	14 May 202118:46	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight - Cloud Native Event Analytics is affected by an Apache Commons Codec vulnerability	15 Dec 202017:42	–	ibm
Check Point Advisories	JavaScript Prototype Pollution (CVE-2020-28269; CVE-2020-28272; CVE-2020-28273; CVE-2020-28442; CVE-2020-28458; CVE-2020-28472; CVE-2020-7778; CVE-2020-8158; CVE-2020-8203; CVE-2021-25912; CVE-2021-44906)	21 Jun 202000:00	–	checkpoint_advisories
CVE	CVE-2020-8158	18 Sep 202020:12	–	cve
Cvelist	CVE-2020-8158	18 Sep 202020:12	–	cvelist
GithubExploit	Exploit for Prototype Pollution in Typeorm	8 Dec 202508:18	–	githubexploit
EUVD	EUVD-2021-1149	7 Oct 202500:30	–	euvd

24 Jul 2020 17:20Current

0.6Low risk

Vulners AI Score0.6

EPSS0.00284

typeorm security vulnerability prototype pollution sql injection denial of service node.js third-party module