Security Bulletin: Vulnerability in Node.js lodash affects IBM Process Mining (CVE-2021-23337,CVE-2020-28500)

Summary There is a vulnerability in Node.js lodash that could allow remote execution of arbitrary commands. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2021-23337 DESCRIPTION: Node.js...

MAL-2023-996 Malicious code in yasap-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ed03840d6456c9d326a3a199bcd1039912300cb2cb1562720875530d698be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yasap-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ed03840d6456c9d326a3a199bcd1039912300cb2cb1562720875530d698be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Detection of Vulnerabilities in JavaScript Libraries

JavaScript is a popular programming language which is an integral component while developing interactive and dynamic web applications. It allows developers to create engaging and responsive user interfaces, handling complex web page elements, enhancing the overall functionality of the application...

Lodash < 4.17.5 Prototype Pollution

According to its self-reported version number, Lodash is prior to 4.17.5. It is, therefore, affected by a prototype pollution vulnerability in the functions merge, mergeWith and defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

Lodash < 4.17.11 Prototype Pollution

According to its self-reported version number, Lodash is prior to 4.17.11. It is, therefore, affected by a prototype pollution vulnerability in the functions merge, mergeWith and defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payloa...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js lodash module vulnerability (CVE-2018-16487)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability. Node.js lodash module CVE-2018-16487 Vulnerability Details CVEID:CVE-2018-16487 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a...

The vulnerabilities of the merge, mergeWith, and defaultsDeep functions in the Lodash library allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the merge, mergeWith, and defaultsDeep functions in the Lodash library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Malicious code in lodash.isstgrng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f50f2c79db7fe5aea1e947df08491dd654c6d5c32ab035ca9f2a270839b024bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lodashfroeach (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 281c7ec11329fae7f591474152da76436f0d91f9246ee789feb6c8f7e4fcdbec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4372 Malicious code in lodasqhcamelcase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4421c3bbe0c34ea2df999dcae19c59defff5d98903dbf8f753b3c5549f5810d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4358 Malicious code in lodash-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 105145df6dade13e96fad0a9e2bf958c1a6681b381296fb5d16a13426a2a9fbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: CVE-2020-28500

Summary Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service ReDoS via the toNumber, trim and trimEnd functions. Vulnerability Details CVEID:CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression...

Security Bulletin: CVE-2021-23337

Summary Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command...

Security Bulletin: CVE-2020-8203

Summary Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20. Vulnerability Details CVEID:CVE-2020-8203 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability usin...

Security Bulletin: CVE-2020-8203

Summary Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution attack. A remote attacker could exploit this vulnerability using the merge, mergeWith, and defaultsDeep functions to inject properties onto Object.prototype to crash the server and possibly execute...

Security Bulletin: Vulnerabilities in lodash library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2019-1010266, CVE-2020-28500, CVE-2018-16487, CVE-2018-3721, CVE-2020-8203, CVE-2021-23337, CVE-2019-10744)

Summary lodash is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. The fix includes lodash v4.17.21. Vulnerability Details CVEID:CVE-2019-1010266 DESCRIPTION: Lodash is vulnerable to a denial of service, caused by uncontrolled resource consumption in Date handler. By...

Malicious code in hs-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11abb41997036fa9a5655dc4cc1f1783db72169e03b63246d8c93964bd1b3b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3687 Malicious code in hs-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11abb41997036fa9a5655dc4cc1f1783db72169e03b63246d8c93964bd1b3b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in get-lodash-template-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7916d6bceee662db12088e55ab01e3ad32487d802c99bf7dc60e63c156d5bf0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...