Prototype Pollution

Overview dotty is a package that can access properties of nested objects using dot-path notation. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter a...

Prototype Pollution

Overview A prototype pollution vulnerability in affected versions of 'dotty' allows attackers to cause a denial of service and may lead to remote code execution. Recommendation Update to version 0.1.1 or later References - GitHub Advisory - CVE...

Prototype pollution in dotty

Prototype pollution vulnerability in 'dotty' before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution...

3m5-coco (>=0.0.2, <=0.0.981), @24hr/sentry-logger-node (>=0.4.0, <=1.2.2) +278 more potentially affected by CVE-2021-25912 via dotty (>=0.0.1, <=0.1.0)

dotty NPM version =0.0.1, =0.0.2, =0.4.0, =1.1.4, =0.0.2, =1.15.3, =0.1.0, =0.1.6, =1.0.4, =0.1.6, =0.1.0, =1.0.0, =1.0.0, =1.0.7 - @kikiemz/komzpol 1.1.2 and more Source cves: CVE-2021-25912 Source advisory: OSV:GHSA-F5C9-X9J6-87QP...

GHSA-F5C9-X9J6-87QP Prototype pollution in dotty

Prototype pollution vulnerability in 'dotty' before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution...

Prototype Pollution in kettek/dot-dotty

Description dot-dotty is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js const DotDotty = require'dot-dotty' let obj = a: 1 let dot = DotDottyobj console.log"Before : " + .polluted; dot'proto.polluted' = 'Yes! Its Polluted'; console.log"After : " +...

Prototype Pollution

dotty is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2021-25912

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

CVE-2021-25912

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

CVE-2021-25912

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

CVE-2021-25912

CVE-2021-25912 is a prototype pollution vulnerability in the Node.js package dotty, affecting versions 0.0.1 through 0.1.0. The flaw allows attackers to cause a denial of service and may lead to remote code execution. The root cause is a type-confusion/policing issue when keys in the path paramet...

CVE-2021-25912

Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution...

PT-2021-16842 · Dotty · Dotty

Name of the Vulnerable Software and Affected Versions: dotty versions 0.0.1 through 0.1.0 Description: The issue is a prototype pollution vulnerability that allows attackers to cause a denial of service and may lead to remote code execution. Recommendations: For dotty versions 0.0.1 through 0.1.0...

Deoxxa Dotty Security Vulnerability

Deoxxa Dotty is a Javascript-based codebase for supporting access to object properties by Deoxxa individual developers. A security vulnerability exists in Deoxxa Dotty versions 0.0.1 through 0.1.0, which stems from a prototype contamination vulnerability that allows an attacker to exploit a denia...

Ubuntu 5.04 : graphviz vulnerability (USN-208-1)

Javier Fernandez-Sanguino Pena discovered that the 'dotty' tool created and used temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running dotty. Note that Tenable Network Security h...