GHSA-2H87-4Q2W-V4HF Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Summary Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. Details Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server....

Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

Summary Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. Details Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server....

Prototype Pollution

cockpit-hq/cockpit is vulnerable to Prototype Pollution. The vulnerability exists due to the use of lodash 4.17.15 which is a platform dependent third party component which allows an attacker to inject properties into existing construct prototypes and modify attributes...

Malicious Package

Overview yasap-lodash is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

K47105354: Lodash library vulnerability CVE-2019-10744

Security Advisory Description Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. CVE-2019-10744 Impact An attacker can use Function inside of...

Lodash 4.17.15 in use which is vulnerable to CVE-2020-8203

Description Lodash 4.17.15 in use which is vulnerable to CVE-2020-8203 Proof of Concept 1 Go to https://localhost/Cockpit/modules/App/assets/vendor/lodash.js?ver=2.3.9-1676855050 and note that lodash version is 4.17.15 2 Go to https://localhost/Cockpit/ 3 Open Web Devloper tools Ctrl+Shift+I usin...

SUSE CVE-2019-10744

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

Security Bulletin: Vulnerability in Lodash affects IBM Process Mining (Multiple CVEs)

Summary There is a vulnerability in Lodash that could allow an attacker to launch a DOS attack. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2019-1010266 DESCRIPTION: Lodash is vulnerable...

Security Bulletin: Vulnerability in Node.js lodash affects IBM Process Mining (CVE-2021-23337,CVE-2020-28500)

Summary There is a vulnerability in Node.js lodash that could allow remote execution of arbitrary commands. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2021-23337 DESCRIPTION: Node.js...

MAL-2023-996 Malicious code in yasap-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ed03840d6456c9d326a3a199bcd1039912300cb2cb1562720875530d698be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yasap-lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ed03840d6456c9d326a3a199bcd1039912300cb2cb1562720875530d698be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Detection of Vulnerabilities in JavaScript Libraries

JavaScript is a popular programming language which is an integral component while developing interactive and dynamic web applications. It allows developers to create engaging and responsive user interfaces, handling complex web page elements, enhancing the overall functionality of the application...

Lodash < 4.17.5 Prototype Pollution

According to its self-reported version number, Lodash is prior to 4.17.5. It is, therefore, affected by a prototype pollution vulnerability in the functions merge, mergeWith and defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

Lodash < 4.17.11 Prototype Pollution

According to its self-reported version number, Lodash is prior to 4.17.11. It is, therefore, affected by a prototype pollution vulnerability in the functions merge, mergeWith and defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payloa...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js lodash module vulnerability (CVE-2018-16487)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability. Node.js lodash module CVE-2018-16487 Vulnerability Details CVEID:CVE-2018-16487 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a...

The vulnerabilities of the merge, mergeWith, and defaultsDeep functions in the Lodash library allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the merge, mergeWith, and defaultsDeep functions in the Lodash library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Malicious code in lodash.isstgrng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f50f2c79db7fe5aea1e947df08491dd654c6d5c32ab035ca9f2a270839b024bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lodashfroeach (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 281c7ec11329fae7f591474152da76436f0d91f9246ee789feb6c8f7e4fcdbec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4372 Malicious code in lodasqhcamelcase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4421c3bbe0c34ea2df999dcae19c59defff5d98903dbf8f753b3c5549f5810d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

yfmw-utils (1.0.0) potentially affected by unknown CVE via lodash-utils (0.0.1-security)

lodash-utils NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on lodash-utils and may be impacted: - yfmw-utils 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-4358...