Prototype Pollution in irrelon-path and @irrelon/path

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions...

GHSA-VP77-FQQP-79J8 Prototype Pollution in decal

This affects all versions of package decal. The vulnerability is in the set function...

Prototype Pollution in decal

This affects all versions of package decal. The vulnerability is in the set function...

Arbitrary Code Execution

Overview total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Arbitrary Code Execution via the U.set and...

Remote Code Execution

total.js is vulnerable to remote code execution. The vulnerability exists in set of utils.js where it does not validate malicious parameter being injected and executed by a malicious user...

PT-2021-15448

Name of the Vulnerable Software and Affected Versions total.js versions prior to 3.4.8 Description The issue concerns Remote Code Execution RCE via the set function. total.js is a framework for Node.js, similar to other frameworks like Laravel or Django, and can be used for various applications...

GHSA-6CF8-QHQJ-VJQM Prototype pollution in total.js

There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impa...

CVE-2020-28449

This affects all versions of package decal. The vulnerability is in the set function...

Design/Logic Flaw

This affects all versions of package decal. The vulnerability is in the set function...

CVE-2020-28449

CVE-2020-28449 corresponds to a prototype pollution vulnerability in the JavaScript package decal, with the issue located in the set function. Affected software is decal (all versions), and exploitation involves injecting properties into Object.prototype (e.g., via proto or path-based definitions...

CVE-2020-28449

This affects all versions of package decal. The vulnerability is in the set function...

CVE-2020-28449: Undefined Security Weakness

This affects all versions of package decal. The vulnerability is in the set function...

PT-2021-11532

Name of the Vulnerable Software and Affected Versions: decal affected versions not specified Description: The issue is related to the set function in the decal package. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Shinuza Decimal-js Security Vulnerability

Shinuza Decimal-js is a Javascript-based codebase used to provide decimal calculations for Node applications by Shinuza Individual Developers. A security vulnerability exists in Shinuza Decimal-js, which stems from the set function...

CVE-2020-28495

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some case...

CVE-2020-28495

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some case...

CVE-2020-28495: Undefined Security Weakness

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some case...

PT-2021-11552

Name of the Vulnerable Software and Affected Versions: total.js versions prior to 3.4.7 Description: The issue is related to a prototype pollution vulnerability in the set function, which can be used to set a value into an object according to a path. However, the keys of the path being set are no...

PT-2020-16968

Name of the Vulnerable Software and Affected Versions shvl versions 1.0.0 through 2.0.1 Description The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. This vulnerability can be exploited because the set...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the set function. PoC const decal = require'decal'; console.log'Before:', .polluted; decal.set, "proto.polluted", "1337"; console.log'After:', .polluted; Details Prototype Pollution is a...