Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to command injection due to the lodash package (CVE-2021-23337)

Summary Lodash is used by DataStage on Cloud Pak for Data as part of data manipulation. Vulnerability Details CVEID:CVE-2021-23337 DESCRIPTION: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. CWE:CWE-94: Improper Control of Generation of Code 'Code...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID:CVE-2020-13949 DESCRIPTION: Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploi...

Malicious code in @hm6816/lodash-isequal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d580612f3b93a1ef18f906fdf2ed034148dd10850978e86b106998902deb0751 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3978 Malicious code in @hm6816/lodash-isequal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d580612f3b93a1ef18f906fdf2ed034148dd10850978e86b106998902deb0751 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-318 Malicious code in webpack-extensive-lodash-replacement-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 845800d2390e86cf58dcd05fd029a2ff2a064fef8ec1bc60b2ad041467db4fdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-3846

Name of the Vulnerable Software and Affected Versions Lodash versions 4.0.0 through 4.17.22 Description Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the .unset and .omit functions. An attacker can leverage crafted paths to trigger the deletion of methods fro...

Malicious code in lodash-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f3565f115c4b58b6ebacb1536e206aa7c84c9f3a0c73b0ebe5628ae94d0546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8059 Malicious code in lodash-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f3565f115c4b58b6ebacb1536e206aa7c84c9f3a0c73b0ebe5628ae94d0546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Prototype Pollution

@75lb/deep-merge is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of deepMerge methods in lodash to merge objects, which can allow attackers to execute arbitrary code, cause a Denial of Service DoS...

@75lb/deep-merge Prototype Pollution vulnerability

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

GHSA-28MC-G557-92M7 @75lb/deep-merge Prototype Pollution vulnerability

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

CVE-2024-38986

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

CVE-2024-38986

CVE-2024-38986 ffects 75lb deep-merge 1.1.1. A prototype-pollution flaw in lodash merge methods could allow an attacker to alter Object.prototype and potentially execute arbitrary code or cause a Denial of Service (DoS). The connected documents consistently describe Prototype Pollution in 75lb de...

PT-2024-28302 · Lodash +1 · Lodash +1

Name of the Vulnerable Software and Affected Versions: 75lb deep-merge version 1.1.1 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS and have other impacts via merge methods of lodash to merge objects. This is due to Prototype Pollution in the...

CVE-2024-38986

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

@75lb/deep-merge Prototype Pollution vulnerability

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

CVE-2024-38986

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service DoS and cause other impacts via merge methods of lodash to merge objects...

Malicious code in lodash.findlastm (npm)

--- -= Per source details. Do not edit below this line.=-...

RHEL 8 : lodash (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - lodash: Prototype pollution in utilities function CVE-2018-3721 Note that Nessus has not tested for this issue but...

ROS-20240418-08

A vulnerability in the Browserify-sign cryptographic functionality duplication package is related to the upper bound check in the dsaVerify function. Exploitation of the vulnerability could allow an attacker, acting remotely, to create signatures that can be successfully verified by any public ke...