Code injection

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

Grunt-Karma security vulnerabilities

grunt-karma is a grunt plugin for Karma by karma-runner individual developers. A security vulnerability exists in karma-runner grunt-karma version 4.0.1, which stems from a prototype contamination vulnerability via the key variable in grunt-karma.js...

CVE-2022-37602

Summary : CVE-2022-37602 is a prototype pollution vulnerability in the npm package grunt-karma 4.0.1 (karma-runner integration), reported across multiple sources. The issue arises via the key variable in grunt-karma.js, enabling an attacker to contaminate object prototypes. CVSSv3.1 base metrics ...

CVE-2022-37602: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

PT-2022-24023 · Unknown · Grunt-Karma +1

Name of the Vulnerable Software and Affected Versions: karma-runner grunt-karma version 4.0.1 Description: The issue is related to a prototype pollution vulnerability in the karma-runner grunt-karma. It occurs via the key variable in grunt-karma.js. Recommendations: For version 4.0.1, consider...

GHSA-56X4-J7P9-FCF9 Command Injection in moment-timezone

Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website, and Alice...

GHSA-V78C-4P63-2J6C Cleartext Transmission of Sensitive Information in moment-timezone

Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...

PT-2022-28198 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions 0.1.0 through 0.5.34 Description: The issue concerns command injection vulnerabilities in moment-timezone. An attacker can execute arbitrary commands on the system running the grunt task with the same privileges as th...

MAL-2022-3475 Malicious code in grunt-contrib5-cop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaed4f8e5074c4986a639e08d41128df82425a2ecf9086e67025287e52d1564 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-contrib5-cop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaed4f8e5074c4986a639e08d41128df82425a2ecf9086e67025287e52d1564 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3474 Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

console-blame (>=1.0.0, <=1.1.1), grunt-lintblame (>=0.1.0, <=0.3.5) +2 more potentially affected by CVE-2020-28434 via gitblame (>=0.1.0, <=0.1.1)

gitblame NPM version =0.1.0, =1.0.0, =0.1.0, =0.2.5, =0.9.5 - tch-lint-jshint 0.0.1 Source cves: CVE-2020-28434 Source advisory: GHSA-3486-RVXC-HRRJ...

console-blame (>=1.0.0, <=1.1.1), grunt-lintblame (>=0.1.0, <=0.3.5) +2 more potentially affected by CVE-2020-28434 via gitblame (>=0.1.0, <=0.1.1)

gitblame NPM version =0.1.0, =1.0.0, =0.1.0, =0.2.5, =0.9.5 - tch-lint-jshint 0.0.1 Source cves: CVE-2020-28434 Source advisory: OSV:GHSA-3486-RVXC-HRRJ...

Prototype Pollution

grunt-util-property is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

GHSA-4HQ8-JGR8-MW9J grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a proto payload...