CVE-2023-46308

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...

Security Bulletin: There is a vulnerability in plotly.js used by IBM Maximo Asset Management application (CVE-2023-46308)

Summary There is a vulnerability in plotly.js used by IBM Maximo Asset Management application CVE-2023-46308 Vulnerability Details CVEID:CVE-2023-46308 DESCRIPTION: Plotly plotly.js could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the...

Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to execute arbitrary code on the system CVE-2023-46308

Summary plotly.js is used by the IBM Datapower Operations Dashboard in their web console. Vulnerability Details CVEID:CVE-2023-46308 DESCRIPTION: Plotly plotly.js could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the plot API calls. By...

SUSE CVE-2023-46308

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...

@12-labours/mapintegratedvuer (>=1.0.0-beta.0 <=1.0.0-beta.14), @abi-software/mapintegratedvuer (>=0.1.0 <=0.6.7) +209 more potentially affected by CVE-2023-46308 via plotly.js (>=1.12.0 <=2.23.2)

plotly.js NPM version =1.12.0, =1.0.0-beta.0, =0.1.0, =0.2.23, =0.2.0, =0.1.27, =1.0.7, =0.9.1, =0.14.1, =1.2.16, =0.0.1, =1.0.0, =0.0.6, =1.0.0, =1.0.3 and more Source cves: CVE-2023-46308 Source advisory: OSV:GHSA-WJC4-73Q6-GV3M...

CVE-2023-46308

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...

CVE-2023-46308

In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...

CVE-2023-46308

CVE-2023-46308 affects the Plotly library plotly.js prior to 2.25.2. The issue is a prototype pollution flaw in the plot API calls (expandObjectPaths/nestedProperty) that could lead to remote code execution or denial of service. Public references indicate the fix is in plotly.js v2.25.2 and later...