37 matches found
CVE-2026-21717
CVE-2026-21717 Vulnerabilidade de Colisão Previsível no Hash de Strings do V8 do Node.js que Leva a Negação de Serviço Visão Geral Uma vulnerabilidade crítica no mecanismo de hash de strings do V8 permite que atacantes causem degradação severa de desempenho em aplicações Node.js. Strings...
@adebaraayomide/synchro_sdk (>=0.0.3, <=0.1.0-synchro-sdk), @akhmetovdev/avalanche (3.0.1) +169 more potentially affected by CVE-2024-57556 via store2 (>=2.3.0, <=2.14.3)
store2 NPM version =2.3.0, =0.0.3, =0.0.3, =1.0.0-alpha.3, =1.4.2, =1.0.0, =2.8.0, =3.0.6-statalanche, =0.1.0, =3.16.1, =1.0.0, =1.0.0, =3.0.5 and more Source cves: CVE-2024-57556 Source advisory: OSV:GHSA-W5HQ-HM5M-4548...
@audius/sdk (>=0.0.3-beta.1, <=3.0.8-beta.12), @audius/stems (>=1.5.2-beta.1, <=1.5.4) +14 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.37.0, <=1.37.2)
@solana/web3.js NPM version =1.37.0, =0.0.3-beta.1, =1.5.2-beta.1, =0.0.3, =0.0.1, =0.2.0, =1.5.1, =0.3.3, =3.2.8, =3.3.0 - @winter-love/wallet 1.0.25-alpha.14 - kyzr-marketplace-sdk 0.0.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...
@vrite/sdk (0.0.4-beta) potentially affected by CVE-2023-5572 via @vrite/sdk (0.0.3-beta)
@vrite/sdk NPM version 0.0.3-beta is affected by a known vulnerability. The following packages have a transitive dependency on @vrite/sdk and may be impacted: - @vrite/sdk 0.0.4-beta Source cves: CVE-2023-5572 Source advisory: OSV:GHSA-W35P-WXWJ-RCM9...
GHSA-5C5F-7VFQ-3732 JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
JMESPath for Ruby using JSON.load instead of JSON.parse
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
CVE-2022-32511
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
Design/Logic Flaw
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
CVE-2022-32511
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
CVE-2022-32511
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
CVE-2022-32511
CVE-2022-32511 affects the Ruby gem jmespath.rb (JMESPath for Ruby)
@phoenix-plugin-registry/hirse.ungit (0.8.3), hirse.ungit (>=0.4.1, <=0.8.3) potentially affected by CVE-2022-25766 via ungit (>=1.1.22, <=1.5.10)
ungit NPM version =1.1.22, =0.4.1, =0.8.3 Source cves: CVE-2022-25766 Source advisory: SNYK:JS-UNGIT-2414099...
GHSA-7QM6-9V49-38M9 Prototype Pollution in record-like-deep-assign
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. PoC js const deepAssign = require'record-like-deep-assign'; let obj = ; console.log"Before being polluted: " + obj.polluted; EVILJSON = JSON.parse'"proto":"polluted":true'; deepAssign...
GHSA-5PXJ-MHWJ-X5GV Prototype Pollution in asciitable.js
The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function. PoC js var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test...
Prototype Pollution in asciitable.js
The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function. PoC js var a = require"asciitable.js"; var b = JSON.parse'"proto":"test":123'; a,b; console.log.test...
@joshmccall/atomic-stories (>=0.0.0-semantically-released, <=1.9.5), abmcontent (0.1.0) +3 more potentially affected by CVE-2020-7787 via react-adal (>=0.3.15, <=0.4.24)
react-adal NPM version =0.3.15, =0.0.0-semantically-released, =0.1.0, =0.1.3 - widgettestcomponent 0.1.0 Source cves: CVE-2020-7787 Source advisory: OSV:GHSA-7MPX-VG3C-CMR4...
Prototype Pollution in babak-gholamzadeh/deeply-object-assign
Description deeply-object-assign is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var deeplyObjectAssign = require"deeply-object-assign" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " +...
Prototype Pollution
merge is vulnerable to prototype pollution. A bypass of the fix for CVE-2018-16469 exists and allows arbitrary properties of the Object prototype to be added or modified via JSON.parse...
HTML Injection in preact
Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input...