970 matches found
GHSA-FM93-FHH2-CG2C Duplicate Advisory: Prototype Pollution in min-dash
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references. Original Description The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement...
Prototype Pollution
min-dash is vulnerable to prototype pollution. The vulnerability exists due to a lack of sanitization for the key types, allowing an attacker to exploit the vulnerability by injecting arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and...
CVE-2021-23460
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...
CVE-2021-23460
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...
CVE-2021-23460 Prototype Pollution
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...
CVE-2021-23460
The CVE-2021-23460 entry concerns the min-dash library (versions before 3.8.1) and a prototype pollution flaw in the set method caused by missing enforcement of key types. Affected software: min-dash; vulnerable component: the set method. Impact described across sources as prototype pollution tha...
min-dash 安全漏洞
min-dash is a minimal utility belt for use with bpmn.io related libraries. A security vulnerability exists in versions prior to min-dash 3.8.1, which stems from the lack of critical type enforcement and makes the software susceptible to prototype contamination via the set method...
Prototype Pollution
Overview min-dash is a Minimal utility tool belt to be used with bpmn.io related libraries. Affected versions of this package are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. PoC: js let parser = require"min-dash"; parser.set, "proto", "polluted",...
entfrm-bpmn (>=8.6.2 <=8.6.6), entfrm-flowable-designer (>=1.0.0 <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (=3.5.2)
min-dash NPM version =3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: SNYK:JS-MINDASH-2340605...
Arbitrary Code Execution
Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via a Gemfile that includes gem entries that use the git option with invalid values with a leading dash. The attacker has to craft a directory containing a Gemfile file that declares a dependency that is located...
DEBIAN-CVE-2021-43809
Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself...
UBUNTU-CVE-2021-43809
Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself...
CVE-2021-43391
An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file an invalid dash counter in line types can trigger a read past the end of an allocated...
CVE-2021-43391
An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file an invalid dash counter in line types can trigger a read past the end of an allocated...
Cross site scripting
An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file an invalid dash counter in line types can trigger a read past the end of an allocated...
PT-2021-23826 · Open Design Alliance · Open Design Alliance Drawings Sdk
Name of the Vulnerable Software and Affected Versions: Open Design Alliance Drawings SDK versions prior to 2022.11 Description: The issue exists within the parsing of DXF files, where crafted data can trigger a read past the end of an allocated buffer, allowing an attacker to execute code in the...
CLSA-2021-1632262065 Update of nscd, glibc-headers, glibc, glibc-utils, glibc-static, glibc-static, glibc-devel, glibc-devel, glibc, glibc-common
More precise DNS name checks accepting dash-.example.com, among other things...
The vulnerability of the `open_generic_xdg_mime` function in the xdg-open component of the Xdg-utils suite, a set of tools for integrating applications into the Xdg environment, arises due to insufficient handling of input data cleaning. This vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the opengenericxdgmime function in the xdg-open component, a toolset for integrating applications into the Xdg environment, is related to incorrect handling of local variables when using the dash library. Exploiting this vulnerability can allow an attacker to gain access to...
DEBIAN-CVE-2021-38185
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is...