nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code...

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

A flaw was found in nodejs-ajv. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code...

@amphro/streamer (>=0.0.0, <=1.0.1), @appirio/demo-scoped-pkg (>=2.4.1, <=2.8.0) +295 more potentially affected by CVE-2020-7777 via jsen (>=0.1.2, <=0.6.6)

jsen NPM version =0.1.2, =0.0.0, =2.4.1, =0.5.9, =0.1.0, =1.0.0, =0.6.9, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc5, =2.2.3, =0.0.1, =0.1.0, =0.0.7, =1.4.0, =13.6.18 and more Source cves: CVE-2020-7777 Source advisory: SNYK:JS-JSEN-1014670...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

UBUNTU-CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

Code injection

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

CVE-2020-15366

CVE-2020-15366 affects Ajv (Another JSON Schema Validator) 6.12.2. A crafted JSON schema can trigger a prototype pollution vulnerability in the ajv.validate() function, potentially allowing execution of arbitrary code. This is explicitly described as enabling code execution via polluted prototype...

CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

PT-2020-14394

Name of the Vulnerable Software and Affected Versions Ajv versions 6.12.2 Description An issue was discovered in ajv.validate that allows execution of other code by prototype pollution when a carefully crafted JSON schema is provided. The worst-case scenario for an untrusted schema should be a...

Node.js third-party modules: Arbitrary code execution via untrusted schemas in ajv

I would like to report an arbitrary code execution vulnerability in ajv. It allows to execute arbitrary code if an attacker-controlled schema is passed to the module. I have confirmed that this should be treated as a security issue. I labeled this as low because this is an unusual scenario, usual...

io.hawt:hawtio-aether (1.2-m5), io.hawt:hawtio-base (1.2-m5) +8 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m5)

io.hawt:hawtio-core MAVEN version 1.2-m5 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m5 - io.hawt:hawtio-base 1.2-m5 - io.hawt:hawtio-dozer 1.2-m5 - io.hawt:hawtio-git 1.2-m5 -...

io.hawt:hawtio-aether (1.4.67), io.hawt:hawtio-base (1.4.67) +17 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.67)

io.hawt:hawtio-core MAVEN version 1.4.67 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.67 - io.hawt:hawtio-base 1.4.67 - io.hawt:hawtio-dozer 1.4.67 - io.hawt:hawtio-git 1.4.67 -...

io.hawt:hawtio-aether (1.2-m1), io.hawt:hawtio-git (1.2-m1) +5 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m1)

io.hawt:hawtio-core MAVEN version 1.2-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m1 - io.hawt:hawtio-git 1.2-m1 - io.hawt:hawtio-json-schema-generator-plugin 1.2-m1 -...

io.hawt:hawtio-aether (1.4.5), io.hawt:hawtio-base (1.4.5) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.5)

io.hawt:hawtio-core MAVEN version 1.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.5 - io.hawt:hawtio-base 1.4.5 - io.hawt:hawtio-dozer 1.4.5 - io.hawt:hawtio-git 1.4.5 -...

io.hawt:hawtio-aether (1.4.14), io.hawt:hawtio-base (1.4.14) +13 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.4.14)

io.hawt:hawtio-core MAVEN version 1.4.14 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.4.14 - io.hawt:hawtio-base 1.4.14 - io.hawt:hawtio-dozer 1.4.14 - io.hawt:hawtio-git 1.4.14 -...

io.hawt:hawtio-aether (1.2-m2), io.hawt:hawtio-dozer (1.2-m2) +9 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2-m2)

io.hawt:hawtio-core MAVEN version 1.2-m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2-m2 - io.hawt:hawtio-dozer 1.2-m2 - io.hawt:hawtio-git 1.2-m2 -...

io.hawt:hawtio-aether (1.2.2), io.hawt:hawtio-base (1.2.2) +7 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (1.2.2)

io.hawt:hawtio-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.hawt:hawtio-core and may be impacted: - io.hawt:hawtio-aether 1.2.2 - io.hawt:hawtio-base 1.2.2 - io.hawt:hawtio-dozer 1.2.2 - io.hawt:hawtio-git 1.2.2 -...