151 matches found
@copart/ops-tool-kit (>=0.0.37, <=0.0.53), @openfin/multer-s3 (>=2.0.0, <=2.2.0) +4 more potentially affected by CVE-2019-20149 via kind-of (6.0.2)
kind-of NPM version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on kind-of and may be impacted: - @copart/ops-tool-kit =0.0.37, =2.0.0, =0.0.1, =0.0.3, =0.1.0, =1.2.6 Source cves: CVE-2019-20149 Source advisory: OSV:GHSA-6C8F-QPHG-QJGP...
Validation Bypass
Overview Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. Recommendation Upgrade to versions 6.0.3 or later. References - GitHub issue -...
kind-of injection vulnerability
kind-of is a JavaScript type checking package. An injection vulnerability exists in the 'ctorName' function of the index.js file in kind-of version v6.0.2, which can be exploited by an attacker to override internal attributes and manipulate the results of type checking...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
AZL-47271 CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
DEBIAN-CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
AZL-44298 CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
UBUNTU-CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
Design/Logic Flaw
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
CVE-2019-20149
CVE-2019-20149 pertains to kind-of v6.0.2 where ctorName in index.js can be overwritten via a crafted payload to alter type-detection results by exploiting a conflicting name (e.g., 'constructor': {'name':'Symbol'}). The IBM QRadar Use Case Manager bulletin (connected doc) aggregates this CVE amo...
CVE-2019-20149
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...
kind-agency.jp XSS vulnerability
Open Bug Bounty ID: OBB-646039 Description| Value ---|--- Affected Website:| kind-agency.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Celebrating the life of Tamir Segal
Trend Micro may be a global organization of more than 5,000 employees, but we’re also a tight-knit family. So it was with great sadness and shock that we heard of the passing of Tamir Segal, who has served as our Israel Country Manager for the past eight years. Our thoughts and prayers are with h...
Chrome V8 PromiseAllResolveElementClosure Element Confusion Vulnerability
Exploit for multiple platform in category dos / poc Chrome: V8: PromiseAllResolveElementClosure can cause elements kind confusion The Promise.all method internally uses PromiseAllResolveElementClosure...
Kind Editor File Upload Vulnerability
Kind Editor is a Web-based , open source , lightweight HTML editor . A security vulnerability exists in Kind Editor version 4.1.12, which originates from the program failing to authenticate. An attacker can exploit the vulnerability to upload files...