25 matches found
CVE-2019-17426
Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...
CVE-2020-17426
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Prototype Pollution in ali-security/mongoose
Impact This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate. For applications using Express and EJS, this can potentially allow remote code execution. Patches The original patched version for mongoose 5.3.3 did not include a fix for...
GHSA-RC4V-99CR-PJCM Prototype Pollution in ali-security/mongoose
Impact This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate. For applications using Express and EJS, this can potentially allow remote code execution. Patches The original patched version for mongoose 5.3.3 did not include a fix for...
K62318311: glibc vulnerability CVE-2017-17426
Security Advisory Description The malloc function in the GNU C Library aka glibc or libc6 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZEMAX, potentially leading to a subsequent heap overflow. This occurs because the...
CVE-2020-17426
CVE-2020-17426 affects Foxit Studio Photo 3.6.6.922 and earlier, where the vulnerability lies in handling CR2 files. The issue stems from insufficient validation of user-supplied data during CR2 file parsing, leading to a memory corruption condition. Exploitation requires user interaction (target...
CVE-2020-25052
An issue was discovered on Samsung mobile devices with Q10.0 exynos9830 chipsets software. H-Arx allows attackers to execute arbitrary code or cause a denial of service memory corruption because indexes are mishandled. The Samsung ID is SVE-2020-17426 August 2020...
CVE-2020-25052
An issue was discovered on Samsung mobile devices with Q10.0 exynos9830 chipsets software. H-Arx allows attackers to execute arbitrary code or cause a denial of service memory corruption because indexes are mishandled. The Samsung ID is SVE-2020-17426 August 2020...
Memory corruption
An issue was discovered on Samsung mobile devices with Q10.0 exynos9830 chipsets software. H-Arx allows attackers to execute arbitrary code or cause a denial of service memory corruption because indexes are mishandled. The Samsung ID is SVE-2020-17426 August 2020...
CVE-2020-25052
CVE-2020-25052 affects Samsung mobile devices running Q(10.0) on exynos9830-based hardware. The issue arises in H-Arx where indexing is mishandled, enabling memory corruption that can be leveraged to execute arbitrary code or cause a denial of service. The vulnerability is documented across multi...
CVE-2020-25052
An issue was discovered on Samsung mobile devices with Q10.0 exynos9830 chipsets software. H-Arx allows attackers to execute arbitrary code or cause a denial of service memory corruption because indexes are mishandled. The Samsung ID is SVE-2020-17426 August 2020...
@abtnode/mongoose-nedb (1.0.16), @andriyf/node-odata (>=0.7.15, <=0.7.1501) +515 more potentially affected by CVE-2019-17426 via mongoose (>=4.0.0-rc4, <=4.13.20)
mongoose NPM version =4.0.0-rc4, =0.7.15, =1.0.7, =0.0.0-alpha.1, =0.0.0, =0.0.1, =2.0.8, =1.2.17, =0.5.10, =0.2.0, =0.2.5-1, =0.1.2-beta.1, =0.4.0, =0.2.0, =0.3.1 and more Source cves: CVE-2019-17426 Source advisory: OSV:GHSA-8687-VV9J-HGPH...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +273 more potentially affected by CVE-2019-17426 via mongoose (>=5.0.0, <=5.7.4)
mongoose NPM version =5.0.0, =0.24.0, =0.0.1, =0.0.2, =1.0.33, =1.0.1, =1.0.1, =1.0.9, =6.5.1, =0.1.8, =3.2.9, =3.4.11 - @codate/email 3.1.0 and more Source cves: CVE-2019-17426 Source advisory: GHSA-8687-VV9J-HGPH...
@abtnode/mongoose-nedb (1.0.16), @andriyf/node-odata (>=0.7.15, <=0.7.1501) +515 more potentially affected by CVE-2019-17426 via mongoose (>=4.0.0-rc4, <=4.13.20)
mongoose NPM version =4.0.0-rc4, =0.7.15, =1.0.7, =0.0.0-alpha.1, =0.0.0, =0.0.1, =2.0.8, =1.2.17, =0.5.10, =0.2.0, =0.2.5-1, =0.1.2-beta.1, =0.4.0, =0.2.0, =0.3.1 and more Source cves: CVE-2019-17426 Source advisory: GHSA-8687-VV9J-HGPH...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +273 more potentially affected by CVE-2019-17426 via mongoose (>=5.0.0, <=5.7.4)
mongoose NPM version =5.0.0, =0.24.0, =0.0.1, =0.0.2, =1.0.33, =1.0.1, =1.0.1, =1.0.9, =6.5.1, =0.1.8, =3.2.9, =3.4.11 - @codate/email 3.1.0 and more Source cves: CVE-2019-17426 Source advisory: OSV:GHSA-8687-VV9J-HGPH...
CVE-2019-17426
Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...
CVE-2019-17426
Automattic Mongoose up to version 5.7.4 is affected. The root cause is that a query object containing a _bsontype attribute is ignored, which can bypass access control in some applications (e.g., a query filter interference with _bsontype). The CVE covers this behavior in older versions of the bs...
47pages-keystone (>=0.0.1, <=0.0.5), @abtnode/mongoose-nedb (1.0.16) +1540 more potentially affected by CVE-2019-17426 via mongoose (>=1.0.0, <=4.13.20)
mongoose NPM version =1.0.0, =0.0.1, =0.7.15, =1.0.7, =0.0.0-alpha.1, =0.0.0, =0.0.1, =2.0.8, =1.2.17, =0.5.10, =0.2.0, =0.2.5-1, =0.0.5, =0.1.2-beta.1, =0.1.2-beta.7 and more Source cves: CVE-2019-17426 Source advisory: MEND:CVE-2019-17426...
3nit-utils (>=0.24.0, <=1.0.2), @36node/template-service (0.3.5) +273 more potentially affected by CVE-2019-17426 via mongoose (>=5.0.0, <=5.7.4)
mongoose NPM version =5.0.0, =0.24.0, =0.0.1, =0.0.2, =1.0.33, =1.0.1, =1.0.1, =1.0.9, =6.5.1, =0.1.8, =3.2.9, =3.4.11 - @codate/email 3.1.0 and more Source cves: CVE-2019-17426 Source advisory: MEND:CVE-2019-17426...
