EUVD-2021-1062

Malware in sbrugna...

Prototype Pollution in confucious

All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function...

GHSA-FMRR-MX6J-H3H5 Prototype Pollution in confucious

All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function...

task-mule (>=1.4.14 <=1.6.0) potentially affected by CVE-2020-7714 via confucious (=0.0.10)

confucious NPM version =0.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on confucious and may be impacted: - task-mule =1.4.14, =1.6.0 Source cves: CVE-2020-7714 Source advisory: OSV:GHSA-FMRR-MX6J-H3H5...

Prototype Pollution

confucious is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-7714

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

Design/Logic Flaw

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

CVE-2020-7714 Prototype Pollution

All versions of package confucious are vulnerable to Prototype Pollution via the set function...

CVE-2020-7714

CVE-2020-7714 affects the npm package confucious via Prototype Pollution in the set function. Affected versions are reported as prior to 0.0.13 (PT-2020-19736), with Snyk listing up to 0.0.12; multiple sources reiterate vulnerability across versions. Root cause is unsafe merging / path-based assi...

PT-2020-19736 · Unknown · Confucious

Name of the Vulnerable Software and Affected Versions: confucious versions prior to 0.0.13 Description: The issue concerns Prototype Pollution via the set function. This allows for potential manipulation of object properties, which can lead to various security issues. Recommendations: For version...

rsg-log-server (>=0.0.2 <=0.0.3), rsg-metrics-server (>=0.0.1 <=0.0.10) +1 more potentially affected by CVE-2020-7714 via confucious (>=0.0.10 <=0.0.9)

confucious NPM version =0.0.10, =0.0.2, =0.0.1, =1.1.0, =1.6.0 Source cves: CVE-2020-7714 Source advisory: SNYK:JS-CONFUCIOUS-598665...

Prototype Pollution

Overview confucious is an App configuration management. Kind of like nconf, but easier to use, predicable and more flexible. Affected versions of this package are vulnerable to Prototype Pollution via the set function. POC: const confucious = require'confucious'; confucious.set'proto:polluted',...