5449 matches found
GHSA-F825-F98C-GJ3G automattic/mongoose vulnerable to Prototype pollution via Schema.path
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification...
JSON Schema Code Execution
The vulnerability of the JSON Schema-based application for checking and testing JSON files is related to insufficient control over the modification of dynamically defined object properties during JSON file processing. Exploiting this vulnerability could allow a malicious actor, operating remotely...
PT-2022-17426 · Mongoose · Mongoose
Name of the Vulnerable Software and Affected Versions: mongoose versions prior to 6.4.6 Description: The issue concerns a Prototype Pollution vulnerability in the mongoose package, a MongoDB object modeling tool. This vulnerability affects the Schema.path function, allowing modification of the...
Automattic Mongoose security vulnerabilities
Automattic Mongoose is a MongoDB object modeling tool for asynchronous environments. A security vulnerability exists in Automattic Mongoose versions prior to 6.4.6, which stems from the Schema.path function being susceptible to prototype contamination when setting up schema objects, which can be...
OESA-2022-1769 nodejs security update
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...
Security Bulletin: IBM Security Verify Information Queue uses a Wire Schema jar with multiple vulnerabilities (CVE-2020-27853, CVE-2021-41093)
Summary The connect image in IBM Security Verify Information Queue ISIQ v10.0.2 uses an older version of the Wire Schema jar file that is vulnerable to remote attackers. ISIQ v10.0.3 upgraded its connect image to include a newer Wire Schema jar that remediates the vulnerabilities. CVE-2020-27853,...
nodejs-json-schema: Prototype pollution vulnerability
The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...
azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2022-33891 via pyspark (2.3.1)
pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2022-33891 Source advisory: OSV:GHSA-4X9R-J582-CGR8...
azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2022-33891 via pyspark (2.3.1)
pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2022-33891 Source advisory: OSV:PYSEC-2022-236...
Fedora: Security Advisory for golang-github-rubenv-sql-migrate (FEDORA-2022-3969b64d4b)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 35 Update: golang-github-rubenv-sql-migrate-0-0.4.20210529gita32ed26.fc35
sql-migrate is a SQL Schema migration tool for Go, based on gorp and goose...
[SECURITY] Fedora 35 Update: golang-github-googleapis-gnostic-0.5.3-6.fc35
This package contains a Go command line tool which converts JSON and YAML OpenAPI descriptions to and from equivalent Protocol Buffer representations. Protocol Buffers provide a language-neutral, platform-neutral, extensible mechanism for serializing structured data. gnostic's Protocol Buffer...
[SECURITY] Fedora 35 Update: golang-github-appc-spec-0.8.11-14.fc35
This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...
GO-2022-0300 Panic via malicious inputs in github.com/graph-gophers/graphql-go
Malicious inputs can cause a panic. A maliciously crafted input can cause a stack overflow and panic. Any user with access to the GraphQL can send such a query. This issue only occurs when using the graphql.MaxDepth schema option which is highly recommended in most cases...
Security Bulletin: Vulnerability in Json-schema library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2021-3918)
Summary Json-schema is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component CVE-2021-3918. Vulnerability Details CVEID: CVE-2021-3918 DESCRIPTION: Json-schema could allow a remote attacker to execute arbitrary code on the system, caused by an improperly controlled modificatio...
CVE-2022-33154
The schema aka Embedding schema.org vocabulary extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS...
CVE-2022-33154
The schema aka Embedding schema.org vocabulary extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS...
CVE-2022-33154
CVE-2022-33154 affects TYPO3 via the Embedding schema.org vocabulary extension. The issue enables cross-site scripting (XSS) through the extension versions prior to 1.13.1 and 2.x prior to 2.5.1. The Red Hat advisory and OSV entries corroborate the same description: the vulnerability stems from i...
CVE-2022-33154: Improper Neutralization of Input During Web Page Generation
The schema aka Embedding schema.org vocabulary extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS...
