664 matches found
UBUNTU-CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
CVE-2020-8203 : Prototype pollution via lodash.zipObjectDeep in lodash versions before 4.17.20. The vulnerability allows modification of object prototypes, enabling attacker-controlled properties. IBM X-Force records this as a high-risk issue (CVSS~7.5; I/H, A/H; network driver with no user inter...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
CVE-2020-8203
Prototype pollution attack when using .zipObjectDeep in lodash before 4.17.20...
Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
Node.js third-party modules: Server-side Template Injection in lodash.js
I would like to report Server-side Template Injection in lodash.js .template function It allows the execution of code on the server Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description The Lodash library exported as Node.js modules. Module...
Prototype Pollution
kibana is vulnerable to prototype pollution. The vulnerability exists through the improper use of set function of lodash in multiple locations, allowing Object.prototype to be overwritten...
RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise...
nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...
Prototype Pollution
Overview Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided...
Node.js third-party modules: Prototype Pollution lodash 4.17.15
I would like to report Prototype Pollution in lodash version 4.17.15 It allows Denial of Service and more. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description The Lodash library exported as Node.js modules. Module Stats 27M in the last wee...
Prototype Pollution
lodash is vulnerable to prototype pollution attack. The vulnerability exists due to the ability to inject properties on Object.prototype using the function zipObjectDeep, leading to DoS, and possibly other forms of attacks...
PT-2020-5991
Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.20 Lodash versions prior to 4.17.19 Description The issue is related to a prototype pollution attack when using the .zipObjectDeep function in Lodash. This can lead to denial of service or code execution under...
Prototype Pollution
Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Prototype Pollution. The function zipObjectDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects. PoC js...
F5 Networks BIG-IP : Lodash library vulnerability (K47105354)
The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory. - Versions of lodash lower than 4.17.12 a...
CVE-2019-10744
A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...
Node.js third-party modules: Prototype pollution attack (lodash)
I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description A modern JavaScript utility library delivering...
Security Bulletin: Possible denial of service vulnerability in Watson Knowledge Catalog for IBM Cloud Pak for Data
Summary There is a possible denial of service vulnerability in some of the Watson Knowledge Catalog for IBM Cloud Pak for Data UI services. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-10744 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service,...