47 matches found
CVE-2021-23440 Prototype Pollution
This affects the package set-value before =3.0.0 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays...
set-value 安全漏洞
set-value is a module that can set nested values on objects using dot representation. A security vulnerability exists in set-value that stems from a type confusion vulnerability that could lead to a bypass of CVE-2019-10747 when the user-supplied key used in the path parameter is an array...
Prototype Pollution
Overview set-value is a package that creates nested values and any intermediaries using dot notation 'a.b.c' paths. Affected versions of this package are vulnerable to Prototype Pollution. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in th...
@alitajs/cordova (>=2.0.0-beta.2, <=2.3.2), @alitajs/create-alita (1.0.0-beta.1) +138 more potentially affected by CVE-2019-10747 +1 more via set-value (>=3.0.0, <=3.0.2)
set-value NPM version =3.0.0, =2.0.0-beta.2, =2.0.0-beta.2, =1.1.21, =1.1.9, =1.0.0, =1.4.0, =1.1.21, =1.0.0-alpha.115, =1.0.0-alpha.1, =1.0.0-alpha.3, =0.0.1, =0.0.1, =1.2.0, =1.2.1 and more Source cves: CVE-2019-10747, CVE-2021-23440 Source advisory: SNYK:JS-SETVALUE-1540541...
RLSA-2021:0549 Moderate: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 12.20.1, nodejs-nodemon 2.0.3. Security Fixes: nodejs-mixin-deep: prototype pollutio...
RHEL 8 : nodejs:12 (RHSA-2021:0549)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0549 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...
Moderate: Red Hat Security Advisory: rh-nodejs12-nodejs security update
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2020-10747
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2020-10747
CVE-2020-10747 is rejected/not used; the CNA withdrew it as not a security issue.
Updated nodejs-set-value packages fix security vulnerability
Updated nodejs-set-value package fixes security vulnerability: A vulnerability was found in NOdejs set-value, where set-value is vulnerable to prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a...
Fedora 31 : nodejs-set-value (2020-582515fa8a)
Update to upstream 2.0.1 release for CVE-2019-10747 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
Fedora 30 : nodejs-set-value (2020-1f1c94907b)
Update to upstream 2.0.1 release for CVE-2019-10747 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
@idearium/cli (>=1.0.0, <=4.3.0), @stoplight/command (>=0.0.11-1, <=0.0.24) +27 more potentially affected by CVE-2019-10747 via set-value (3.0.0)
set-value NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on set-value and may be impacted: - @idearium/cli =1.0.0, =0.0.11-1, =0.0.11-29, =0.0.11-1, =0.0.11-1, =0.0.11-1, =0.0.18, =0.0.11-1, =0.0.11-1, =0.0.11-30, =0.0.11-1, =0.0.18,...
CVE-2019-10747
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads...
CVE-2019-10747
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads...
CVE-2019-10747
CVE-2019-10747 : The Node.js module set-value is vulnerable to a prototype-pollution flaw that can modify Object.prototype via constructor/proto payloads in the path parameter. Connected IBM/IBM X-Force sources confirm exploitation could lead to a denial of service; remediation involves upgrading...
CVE-2019-10747
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads...
@idearium/cli (>=1.0.0, <=4.3.0), @stoplight/command (>=0.0.11-1, <=0.0.24) +27 more potentially affected by CVE-2019-10747 via set-value (3.0.0)
set-value NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on set-value and may be impacted: - @idearium/cli =1.0.0, =0.0.11-1, =0.0.11-29, =0.0.11-1, =0.0.11-1, =0.0.11-1, =0.0.18, =0.0.11-1, =0.0.11-1, =0.0.11-30, =0.0.11-1, =0.0.18,...
CVE-2018-10747
Affected product: D-Link DSL-3782 EU version 1.01. In the Diagnostics component, the /userfs/bin/tcapi binary accepts an unset parameter. An authenticated user can supply a long buffer to unset and trigger memory corruption, potentially redirecting program flow and enabling arbitrary code execut...