JerryScript 安全漏洞

JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in JerryScript 3.0.0, which stems from an assertion in /jerry-core/parser/js/js-parser-expr.c flags & PARSERPATTERNHASRESTELEMENT fails. No details of the vulnerability are currently provided...

OSV-2021-950 Dynamic-stack-buffer-overflow in std::__1::__wrap_iter<hsql::Expr**>::__wrap_iter

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35944 Crash type: Dynamic-stack-buffer-overflow WRITE 8 Crash state: std::1::wrapiter::wrapiter std::1::vector ::makeiter std::1::vector ::begin...

PT-2021-28315

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 4 crash has been reported. The crash involves the functions cil cat expr range to bitmap helper, cil expr to bitmap, and...

property-expr Prototype Pollution

The vulnerability of the Aurora Application Library is related to uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability allows a remote attacker to execute an “infection of the prototype” attack...

Prototype Pollution in property-expr

Overview property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function. Recommendation Upgrade to version 2.0.3 or later References - CVE - GitHub Advisory...

Prototype Pollution in property-expr

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function...

svelte-forms-lib (>=1.1.1, <=1.3.2) potentially affected by CVE-2020-7707 via property-expr (2.0.2)

property-expr NPM version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on property-expr and may be impacted: - svelte-forms-lib =1.1.1, =1.3.2 Source cves: CVE-2020-7707 Source advisory: OSV:GHSA-6FW4-HR69-G3RV...

Prototype Pollution in silentmatt/expr-eval

✍️ Description With speficific input attckers can define properties on prototype, which will lead to prototype pollution. Need node version=12.0.0, which introduce Object.fromEntries 🕵️‍♂️ Proof of Concept // PoC.js const Parser = require'expr-eval'; const o = ; console.log"o.a=", o.a; // o.a=...

Prototype Pollution

property-expr is vulnerable to prototype pollution. An attacker is able to add and modify properties of Object.prototype using a proto payload...

CVE-2020-7707

CVE-2020-7707 affects the Node.js property-expr module (versions before 2.0.3). Root cause is a prototype pollution flaw in the setter function, enabling remote attackers to execute arbitrary code. Affected: property-expr

CVE-2020-7707

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7707: Improperly Controlled Modification of Object Prototype Attributes

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function...

PT-2020-6067 · Unknown · Property-Expr

Name of the Vulnerable Software and Affected Versions: property-expr versions prior to 2.0.3 Description: The issue is related to Prototype Pollution via the setter function. It may allow a remote attacker to perform a prototype pollution attack by exploiting uncontrolled modification of object...

svelte-forms-lib (>=1.1.1, <=1.3.2) potentially affected by CVE-2020-7707 via property-expr (2.0.2)

property-expr NPM version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on property-expr and may be impacted: - svelte-forms-lib =1.1.1, =1.3.2 Source cves: CVE-2020-7707 Source advisory: SNYK:JS-PROPERTYEXPR-598800...

PT-2020-21891

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description A crash occurred due to an unknown read issue, as reported by OSS-Fuzz. The crash state involves eval expr and eval binary functions. No information is available about the estimated numbe...

Node.js third-party modules: property-expr - Prototype pollution

I would like to report Prototype pollution in property-expr It allows attacker to modify the prototype of a base object. Module module name: property-expr version: 2.0.2 npm page: https://www.npmjs.com/package/property-expr Module Description Tiny property path utilities, including path parsing a...

llvm:clang-objc-fuzzer: Segv on unknown address in clang::Expr::EvaluateKnownConstInt

Detailed Report: https://oss-fuzz.com/testcase?key=5105673205710848 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clang-objc-fuzzer Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: clang::Expr::EvaluateKnownConstInt...

Netwide Assembler Buffer Overflow Vulnerability (CNVD-2020-02979)

Netwide Assembler NASM is a Linux-based assembler. The product is capable of creating binaries and writing bootloaders. A buffer overflow vulnerability exists in the expr function of the asm/eval.c file in version 2.14.02 of Netwide Assembler NASM. The vulnerability stems from a networked system ...

CVE-2019-20334

In Netwide Assembler NASM 2.14.02, stack consumption occurs in expr functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 and stdscan in asm/stdscan.c. This is similar to CVE-2019-6290 and CVE-2019-6291...

CVE-2019-20334

In Netwide Assembler NASM 2.14.02, stack consumption occurs in expr functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 and stdscan in asm/stdscan.c. This is similar to CVE-2019-6290 and CVE-2019-6291...