Moderate: Red Hat Security Advisory: Red Hat OpenShift (Logging Subsystem) security update

Logging Subsystem 5.6.1 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Referenc...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to [CVE-2022-46175]

Summary Node.js module JSON5 is used by IBM App Connect Enterprise Certified Container for parsing JSON. IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported vulnerability in Node.js...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to json5 (CVE-2022-46175)

Summary IBM App Connect Enterprise is vulnerable to a remote authenticated attacker executing arbitrary code due to json5 CVE-2022-46175. The resolving fix includes json5 v2.2.3 Vulnerability Details CVEID:CVE-2022-46175 DESCRIPTION: JSON5 could allow a remote authenticated attacker to execute...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js json5

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js json5. Vulnerability Details CVEID:CVE-2022-46175 DESCRIPTION: JSON5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw...

Fedora 37 : pgadmin4 (2023-e7297a4aeb)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e7297a4aeb advisory. Update to pgadmin4-6.19. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Prototype Pollution

json5 is vulnerable to prototype pollution. The vulnerability exists in the internalize function in parse.js due to not restricting keys named proto which allows an attacker to inject specially crafted strings to pollute the prototype of the resulting object...

6ix (0.0.0-canary.0), 9ight (>=0.0.0-canary.0, <=0.0.0-canary.6) +803 more potentially affected by CVE-2022-46175 via json5 (>=2.0.0, <=2.2.1)

json5 NPM version =2.0.0, =0.0.0-canary.0, =0.4.0, =0.0.1, =0.0.1, =0.0.1, =1.2.0, =0.3.0-next.1, =0.3.0-next.1, =0.3.0-next.1, =0.3.0-next.1, =0.3.0-next.1, =0.0.2, =0.0.2, =1.1.0, =1.2.1 and more Source cves: CVE-2022-46175 Source advisory: OSV:GHSA-9C47-M6QQ-7P4H...

46c-sector (>=1.0.0, <=1.2.1), @abtasty-innovation/cb-tag (>=0.0.1, <=0.1.3) +176 more potentially affected by CVE-2022-46175 via json5 (1.0.1)

json5 NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on json5 and may be impacted: - 46c-sector =1.0.0, =0.0.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =2.2.0, =0.0.1, =2.1.0, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - @brocan/inp...

Prototype Pollution in JSON5 via Parse Method

The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the...

CVE-2022-46175

A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

DEBIAN-CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

Cross site scripting

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

CVE-2022-46175

CVE-2022-46175 (JSON5 Prototype Pollution) The JSON5 library up to v1.0.1 and v2.2.1 fails to restrict keys named proto in JSON5.parse, enabling prototype pollution on the returned object. This can lead to arbitrary keys on the polluted object and, depending on usage, may cause denial of service,...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

CVE-2022-46175

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand e.g. for config files. The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named proto, allowing specially crafted strings t...

PT-2022-7147

Name of the Vulnerable Software and Affected Versions json5 versions 1.0.1 and earlier json5 versions 2.2.1 and earlier Description The parse method of the json5 library does not restrict parsing of keys named proto , allowing specially crafted strings to pollute the prototype of the resulting...