ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name as demonstrated by 'constructor': {'name':'Symbol'}. Hence a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

🗓️ 11 Sep 2024 07:00:00Reported by MicrosoftType

External input can override kind-of internal attributes via constructor name, altering type detection.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	1 Aug 202314:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM QRadar Use Case Manager app	2 Dec 202514:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites affect IBM Engineering products.	29 Mar 202121:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: OSS security Scan issues for Concerto installer.	8 Dec 202006:37	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple vulnerabilties affecting Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:39	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Security issues for NPS console.	15 Dec 202007:03	–	ibm
IBM Security Bulletins	Security Bulletin: OSS scan fixes for Content pos	15 Dec 202006:58	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: js-jquery (CVE-2019-20149)	10 Feb 202500:00	–	nessus